Brocade
Monthly
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Unauthenticated attackers with adjacent-network reachability can push an unauthorized Certificate Authority certificate into the TLS client trust store of Brocade ASCG (all versions before 3.5.0), because the product's management interface accepts CA certificates without authentication. A successful injection lets an on-path adversary Man-in-the-Middle the outbound TLS connections ASCG establishes to the managed Fibre Channel switches and peer nodes it administers, producing high confidentiality and integrity impact (CVSS 7.6; CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N; independent CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Because the vector is PR:N the certificate submission is unauthenticated, but exploitation still requires the attacker to be logically adjacent to the management plane (AV:A) and, for the MITM payoff, to hold an on-path position between ASCG and its outbound peers (AT:P) - no public exploit code and no CISA KEV entry were identified at time of analysis, so this is a genuine but moderate-priority issue rather than an urgent emergency.
Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to fully compromise the SupportLink API component due to a hard-coded cryptographic key (CWE-321) shared across all deployments. Exploitation requires adjacent network access and recovery of the key, but no public exploit code has been identified at time of analysis. The vendor has released version 3.5.0 to address the flaw.
Path traversal in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 lets an unauthenticated attacker write arbitrary files to restricted host locations by embedding traversal sequences in entries of a support-bundle archive that ASCG ingests from remote endpoints, with the potential for follow-on remote code execution if a written path is later executed or loaded. The attack is not internet-facing: exploitation is scored AV:A (adjacent network) with the CVSS 4.0 AT:P precondition, meaning the attacker must already control or be able to man-in-the-middle support bundles originating from a compromised or spoofed ingesting endpoint. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the practical risk is a moderate, conditional one that depends on an attacker holding a management-network position and a compromised ingestion source rather than an urgent, broadly exploitable issue.
Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed.
Local privilege escalation in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 stems from a well-known Brocade default password embedded in a script that is distributed to every customer, allowing any local authenticated user with read access to the installation path to recover the credential and elevate privileges on Open Virtual Appliance (OVA) deployments where default configuration settings remain in place. The flaw is rated 7.0 (High) under CVSS 4.0 with a local vector (AV:L, PR:L, UI:P), meaning an attacker must already hold a low-privilege local account and passive user interaction is required, so it is not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated on OVA deployments that have not rotated the default credential.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis.
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks.
Information disclosure in Brocade SANnav before 2.4.0b and 3.0.0 occurs because the product writes encoded passwords and authentication tokens to log files, including the SANnav supportsave diagnostic bundle. An attacker who gains access to those logs or the supportsave output can recover secrets and potentially reuse them, though the description frames this as requiring an authenticated attacker with file-level access and the assessed vector reflects a local/authenticated prerequisite; the input CVSS 4.0 vector lists PR:N, a discrepancy that should be confirmed with the vendor. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-adjacent attacker reach an unprotected endpoint in the web management interface's Single Sign-On workflow and obtain administrative access to the device. No credentials or user interaction are required (PR:N/UI:N), although High attack complexity (AC:H) means conditions outside the attacker's control must line up for reliable exploitation, and exposure is confined to MXG610 deployments with a reachable management interface. No public exploit code has been identified at the time of analysis, and there is no confirmation of active exploitation.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrative users of the Brocade Fabric OS configuration-management CLI can read arbitrary files on the switch's local operating system - including sensitive configuration files, password hashes and system secrets - by injecting unsanitized arguments through the search-pattern filter of configuration-viewing commands. The flaw is an argument-injection issue (CWE-88) affecting Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires a valid administrative CLI account (PR:H in the CVSS 4.0 vector, PR:L in the independent assessment) plus adjacent-network reachability to the management plane (AV:A); no unauthenticated or internet-facing exploitation path is indicated. Risk is genuine but conditional rather than a drop-everything emergency: no public exploit identified at time of analysis, no CISA KEV listing, and the assessed impact is predominantly confidentiality loss with a scope change (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), while the vendor-side score is 8.4 under CVSS 4.0.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Privilege escalation in Brocade Fabric OS (versions before 10.0.1) allows a low-privilege authenticated account to obtain root-equivalent chassis administrative access when the switch is configured to use an external AAA identity source. The switch fails to constrain crafted Vendor-Specific Attributes or directory claims returned by RADIUS, LDAP, TACACS+, or a Federated IdP against its administrative role restrictions during session establishment, so an attacker who can influence those returned attributes is granted full control. Exploitation is conditional rather than mass-scale: it requires external AAA integration to be configured (deployments using only local authentication are unaffected), a valid low-privilege account (CVSS PR:L), management-network adjacency (AV:A), and attacker influence over IdP-returned attributes (AT:P); no public exploit code was identified at time of analysis, and vendor-released patch version 10.0.1 is available.
Brocade Fabric OS Management Server before version 10.0.1 can be manipulated by a compromised or rogue Fibre Channel switch that is already trusted within the fabric, which uses crafted inband vendor-unique Common Transport (CT) management requests to bypass administrative authentication. This lets the unauthorized peer perform sensitive administrative actions on the target device, including resetting administrative passwords, rebooting the system, and initiating firmware downloads. The attack is confined to the Fibre Channel fabric and cannot be launched from the management IP network or the internet; it requires a pre-compromised fabric peer (assessed AV:A/AC:H with an AT:P precondition in the vendor vector), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Read-only management accounts on Brocade Fabric OS switches can escalate to restricted administrative operations by submitting management-protocol requests whose non-standard action opcodes the RBAC validation engine mis-categorizes during its permission check; the flaw affects Fabric OS releases before 10.0.1 and is scored CVSS 4.0 base 7.1 (CWE-269, improved privilege management failure). Exploitation is gated: an attacker must already hold a valid authenticated read-only management account (PR:L) and be positioned on an adjacent/management network (AV:A) to reach the affected management plane, with no user interaction required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so practical risk is driven by the attacker's existing credentials and management-network access rather than by remote unauthenticated reachability.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric.
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SANnav versions before 3.0.1a, so anyone who can read those logs or an exported support bundle can recover credentials that protect network tunnels. The exposure is triggered only when IPsec policies are actually created or modified in SANnav, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, authenticated precondition rather than anonymous remote reach, meaning an insider or a holder of an exported bundle is the realistic actor. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so priority should be driven by the sensitivity of the logged keys and by how broadly log files and support bundles are shared; the vendor has addressed it in 3.0.1a.
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service log files lets anyone who can read those logs - or who is handed an exported support bundle - recover credentials that unlock the managed SAN fabric. All SANnav releases before 3.0.1a are affected, and the logging occurs under default configuration, so the only barrier is obtaining local read access to the log directory or bundle; the CVSS v3.1 assessment (8.5, AV:L/AC:L/PR:L/UI:N, C/I/A:H) and the vendor-published CVSS v4.0 vector (8.5) both place this at high severity because a successful read escalates into full compromise of managed switches and active user sessions. Exploitation is access-gated rather than remote or unauthenticated, and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE. Actual fabric compromise is a second step contingent on the disclosed credentials still being valid and the switches being reachable.
Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV).
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-execution/scripting permissions break out of the restricted allow-list execution context and run unauthorized shell commands across managed fabric switches, escalating to full administrative switch access. Exploitation requires a valid SANnav account with scripting rights and adjacency to the SAN management plane (AV:A, PR:L) - the product is not internet-reachable by default - and no user interaction is needed once that foothold exists. Every SANnav release before 3.0.1a is in scope per the CPE (cpe:2.3:a:brocade:sannav:*:*:*:*:*:*:*:*), and no public exploit code has been identified at time of analysis; this is a genuine mid-to-high priority for SANnav operators, not an emergency-tier internet-facing issue.
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. No public exploit code or confirmed active exploitation was identified at time of analysis.
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Unauthenticated querying of internal management endpoints in Brocade ASCG releases before 3.5.0 discloses the configuration and operating state of the Brocade Fabric OS (FOS) switches that the appliance manages, exposing a customer's SAN fabric topology and switch connectivity attributes. An attacker only needs to be positioned on the same or adjacent management/storage network segment (CVSS AV:A, PR:N, UI:N) to reach those endpoints; no credentials or user interaction are required. Impact is read-only information disclosure with no integrity or availability effect, and no public exploit code or confirmed active exploitation was identified at time of analysis, keeping real-world priority low-to-moderate rather than urgent.
An authenticated path traversal (CWE-22) in the Zone Alias Import flow of Brocade SANnav before 3.0.0a allows an attacker who already holds valid SANnav credentials to write uploaded content outside the intended upload directory, corrupting or planting files on the management host. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confines impact to integrity only, with no confidentiality or availability effect and no user interaction required; per the vendor's CVSS 4.0 vector the attack surface is the management interface reached from an adjacent network segment. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, authenticated file-write issue rather than a top-priority emergency.
Authenticated SQL injection in Brocade SANnav before 3.0.0a allows an attacker with low privileges and adjacent-network access to the SANnav management plane to supply malicious values in specific external API inventory REST API query parameters, which are then used in SQL queries. The vendor rates this as moderate severity with CVSS 4.0 score 6.1; the independent assessment matches an authenticated, adjacent-network profile (PR:L, AV:A, UI:N) with limited confidentiality impact under scope change. No public exploit identified at time of analysis, and no CISA KEV entry is provided.
Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.
OS command injection in the PAM session-cleanup path of Brocade Fabric OS (before 9.2.2d, and 10.0.0 through 10.0.0a1) lets an authenticated user whose directory- or AAA-supplied username or profile identifier contains shell metacharacters execute arbitrary commands as root when their remote SSH session terminates. Three prerequisites must hold simultaneously: the switch must authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than local accounts only, the attacker must be able to set or influence the username/profile identifier in that directory, and the attacker must be able to establish and then close an authenticated SSH session - so switches using only local authentication are not exposed. No public exploit has been identified at time of analysis; vendor-released patch: 9.2.2d for the 9.x branch, with the corresponding fixed 10.0.x release described in the Broadcom/Brocade advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39147.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. Only Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 branch are affected, with a vendor advisory published by Broadcom.
OS command injection in Brocade Fabric OS account management affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated administrator with adjacent management-network access can instigate account deletion, and if the target account has a malformed name containing shell metacharacters-accepted by older Fabric OS builds-the internal cryptographic-key cleanup routine may execute injected commands. This is a medium-severity (CVSS 4.0 base 5.4) issue with low-to-moderate real-world risk because exploitation requires admin privileges, adjacent access, an operator UI action, and the non-default precondition of a pre-existing malformed account name; no public exploit has been identified at time of analysis.
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file and directory deletion in Brocade Fabric OS before 10.0.1 lets an authenticated operator who already holds USB management privileges break out of the intended USB mount point through path manipulation in the REST API USB storage handling and remove files or directories anywhere on the switch local root filesystem. The attack surface is narrow: the interface is reachable only from the adjacent management network (AV:A), requires a high-privileged account (PR:H), and the vendor vector includes an additional attack requirement (AT:P), so this is a trusted-operator or stolen-admin-credential scenario rather than an anonymous remote attack. No public exploit identified at time of analysis; the vendor rates the issue 5.7 under CVSS 4.0 and the independent assessment treats it as a medium-severity, low-to-moderate priority issue that affects integrity only, not an emergency.
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.
Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.
Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.
A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). The result is limited to a denial of service (process crash) with no code execution or data disclosure claimed; there is no CISA KEV listing and no public exploit code identified at time of analysis, and independent assessment rates this as a moderate-priority availability issue rather than a critical one.
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. Impact is limited to confidentiality of the proxy credentials (CVSS 4.0 score 6.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) with no integrity or availability effect, and no public exploit identified at time of analysis.
Brocade Fabric OS releases before 10.0.1 expose an authorization logic flaw in the REST API gateway, where the gate protecting restricted internal management endpoints trusts client-controlled HTTP headers, so any holder of a valid REST session-regardless of privilege level-can spoof those headers and read sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. Exploitation requires an already-authenticated low-privilege REST session (PR:L) and adjacent-network reachability to the gateway (AV:A), and the impact is limited to read-only information disclosure with no integrity or availability effect, consistent with the assessed CVSS 5.1. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a modest-severity issue that is largely contained unless the REST interface is reachable from routed or untrusted networks.
Missing authorization controls in the Brocade Fabric OS REST API on releases before 10.0.1 allow any authenticated API user - regardless of assigned role or administrative scope - to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. The exposure is limited to information disclosure of chassis-wide health metrics, port performance violations, and configuration data; there is no write, code-execution, or availability impact, and the attacker must already hold valid Fabric OS credentials and have adjacent/management-network reachability to the API. There is no public exploit identified at time of analysis, and the issue is best characterized as a modest-priority information disclosure flaw rather than a system-compromise vector.
Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).
Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. Exploitation requires adjacent-network reachability to the management interface (CVSS 4.0 AV:A, PR:N, impact limited to low confidentiality with no integrity or availability effect), and no public exploit code has been identified at time of analysis; the practical risk is concentrated on switches whose management ports are reachable from non-management segments rather than strictly out-of-band networks.
Incomplete property masking in Brocade SANnav's logging subsystem can cause SNMP authentication and privacy passwords to be written into application logs whenever specific configuration conditions are met, so anyone who can read those logs or a generated support bundle can recover the credentials and use them for unauthorized read or management access to the monitored switch environment. The flaw is not remotely exploitable by an unauthenticated attacker: per the available CVSS data (PR:L) and our independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), exploitation requires an actor who already holds log or support-bundle read privileges, and the sensitive values only appear under non-universal configuration conditions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical risk is a credential-hygiene and information-disclosure exposure realized by insiders or by a post-compromise actor who reuses the recovered SNMP credentials against reachable switches.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and archive protection keys to be written unmasked into application logs and generated support bundles whenever scheduled support-save or related operational jobs execute. An authenticated, low-privileged user who already has read access to those logs or bundles can harvest the credentials and potentially reuse them against remote backup targets or protected archives. This is a confidentiality-only defect rooted in improper log masking (CWE-532), with no public exploit identified at time of analysis; practical impact is LOW-priority because the attacker must already hold log access and the secrets are only exposed after an affected job has actually run.
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Rated high severity (CVSS 7.0). This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.4% and no vendor patch available.
A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 24.1% and no vendor patch available.
A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a logged-in user into making administrative changes on the. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00, and 6.0.00a images could allow attackers to cause a denial of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.
The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveraging membership in the operator group. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before. Rated medium severity (CVSS 5.4). No vendor patch available.
The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA. Rated medium severity (CVSS 5.4). No vendor patch available.
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Unauthenticated attackers with adjacent-network reachability can push an unauthorized Certificate Authority certificate into the TLS client trust store of Brocade ASCG (all versions before 3.5.0), because the product's management interface accepts CA certificates without authentication. A successful injection lets an on-path adversary Man-in-the-Middle the outbound TLS connections ASCG establishes to the managed Fibre Channel switches and peer nodes it administers, producing high confidentiality and integrity impact (CVSS 7.6; CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N; independent CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Because the vector is PR:N the certificate submission is unauthenticated, but exploitation still requires the attacker to be logically adjacent to the management plane (AV:A) and, for the MITM payoff, to hold an on-path position between ASCG and its outbound peers (AT:P) - no public exploit code and no CISA KEV entry were identified at time of analysis, so this is a genuine but moderate-priority issue rather than an urgent emergency.
Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to fully compromise the SupportLink API component due to a hard-coded cryptographic key (CWE-321) shared across all deployments. Exploitation requires adjacent network access and recovery of the key, but no public exploit code has been identified at time of analysis. The vendor has released version 3.5.0 to address the flaw.
Path traversal in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 lets an unauthenticated attacker write arbitrary files to restricted host locations by embedding traversal sequences in entries of a support-bundle archive that ASCG ingests from remote endpoints, with the potential for follow-on remote code execution if a written path is later executed or loaded. The attack is not internet-facing: exploitation is scored AV:A (adjacent network) with the CVSS 4.0 AT:P precondition, meaning the attacker must already control or be able to man-in-the-middle support bundles originating from a compromised or spoofed ingesting endpoint. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the practical risk is a moderate, conditional one that depends on an attacker holding a management-network position and a compromised ingestion source rather than an urgent, broadly exploitable issue.
Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed.
Local privilege escalation in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 stems from a well-known Brocade default password embedded in a script that is distributed to every customer, allowing any local authenticated user with read access to the installation path to recover the credential and elevate privileges on Open Virtual Appliance (OVA) deployments where default configuration settings remain in place. The flaw is rated 7.0 (High) under CVSS 4.0 with a local vector (AV:L, PR:L, UI:P), meaning an attacker must already hold a low-privilege local account and passive user interaction is required, so it is not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated on OVA deployments that have not rotated the default credential.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis.
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks.
Information disclosure in Brocade SANnav before 2.4.0b and 3.0.0 occurs because the product writes encoded passwords and authentication tokens to log files, including the SANnav supportsave diagnostic bundle. An attacker who gains access to those logs or the supportsave output can recover secrets and potentially reuse them, though the description frames this as requiring an authenticated attacker with file-level access and the assessed vector reflects a local/authenticated prerequisite; the input CVSS 4.0 vector lists PR:N, a discrepancy that should be confirmed with the vendor. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-adjacent attacker reach an unprotected endpoint in the web management interface's Single Sign-On workflow and obtain administrative access to the device. No credentials or user interaction are required (PR:N/UI:N), although High attack complexity (AC:H) means conditions outside the attacker's control must line up for reliable exploitation, and exposure is confined to MXG610 deployments with a reachable management interface. No public exploit code has been identified at the time of analysis, and there is no confirmation of active exploitation.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated administrative users of the Brocade Fabric OS configuration-management CLI can read arbitrary files on the switch's local operating system - including sensitive configuration files, password hashes and system secrets - by injecting unsanitized arguments through the search-pattern filter of configuration-viewing commands. The flaw is an argument-injection issue (CWE-88) affecting Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires a valid administrative CLI account (PR:H in the CVSS 4.0 vector, PR:L in the independent assessment) plus adjacent-network reachability to the management plane (AV:A); no unauthenticated or internet-facing exploitation path is indicated. Risk is genuine but conditional rather than a drop-everything emergency: no public exploit identified at time of analysis, no CISA KEV listing, and the assessed impact is predominantly confidentiality loss with a scope change (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), while the vendor-side score is 8.4 under CVSS 4.0.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Privilege escalation in Brocade Fabric OS (versions before 10.0.1) allows a low-privilege authenticated account to obtain root-equivalent chassis administrative access when the switch is configured to use an external AAA identity source. The switch fails to constrain crafted Vendor-Specific Attributes or directory claims returned by RADIUS, LDAP, TACACS+, or a Federated IdP against its administrative role restrictions during session establishment, so an attacker who can influence those returned attributes is granted full control. Exploitation is conditional rather than mass-scale: it requires external AAA integration to be configured (deployments using only local authentication are unaffected), a valid low-privilege account (CVSS PR:L), management-network adjacency (AV:A), and attacker influence over IdP-returned attributes (AT:P); no public exploit code was identified at time of analysis, and vendor-released patch version 10.0.1 is available.
Brocade Fabric OS Management Server before version 10.0.1 can be manipulated by a compromised or rogue Fibre Channel switch that is already trusted within the fabric, which uses crafted inband vendor-unique Common Transport (CT) management requests to bypass administrative authentication. This lets the unauthorized peer perform sensitive administrative actions on the target device, including resetting administrative passwords, rebooting the system, and initiating firmware downloads. The attack is confined to the Fibre Channel fabric and cannot be launched from the management IP network or the internet; it requires a pre-compromised fabric peer (assessed AV:A/AC:H with an AT:P precondition in the vendor vector), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Read-only management accounts on Brocade Fabric OS switches can escalate to restricted administrative operations by submitting management-protocol requests whose non-standard action opcodes the RBAC validation engine mis-categorizes during its permission check; the flaw affects Fabric OS releases before 10.0.1 and is scored CVSS 4.0 base 7.1 (CWE-269, improved privilege management failure). Exploitation is gated: an attacker must already hold a valid authenticated read-only management account (PR:L) and be positioned on an adjacent/management network (AV:A) to reach the affected management plane, with no user interaction required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so practical risk is driven by the attacker's existing credentials and management-network access rather than by remote unauthenticated reachability.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be written in cleartext to system logs during the bulk IPsec policy collection workflow, allowing any principal with read access to container logs or exported support archives to recover those keys and potentially compromise the IPsec-protected tunnels that rely on them. The issue is local and authenticated (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, confidentiality-only per independent assessment), not remotely reachable, and it is tied specifically to that diagnostic collection path rather than to arbitrary attacker input; no public exploit code has been identified at time of analysis. The 8.4 CVSS 4.0 vendor score (which also asserts high integrity impact via VI:H) should not be used as the sole triage signal, since the practical outcome depends on the attacker both holding log/support-bundle read privileges and being able to reach and reuse the leaked PSKs against the switch fabric.
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SANnav versions before 3.0.1a, so anyone who can read those logs or an exported support bundle can recover credentials that protect network tunnels. The exposure is triggered only when IPsec policies are actually created or modified in SANnav, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local, authenticated precondition rather than anonymous remote reach, meaning an insider or a holder of an exported bundle is the realistic actor. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so priority should be driven by the sensitivity of the logged keys and by how broadly log files and support bundles are shared; the vendor has addressed it in 3.0.1a.
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service log files lets anyone who can read those logs - or who is handed an exported support bundle - recover credentials that unlock the managed SAN fabric. All SANnav releases before 3.0.1a are affected, and the logging occurs under default configuration, so the only barrier is obtaining local read access to the log directory or bundle; the CVSS v3.1 assessment (8.5, AV:L/AC:L/PR:L/UI:N, C/I/A:H) and the vendor-published CVSS v4.0 vector (8.5) both place this at high severity because a successful read escalates into full compromise of managed switches and active user sessions. Exploitation is access-gated rather than remote or unauthenticated, and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE. Actual fabric compromise is a second step contingent on the disclosed credentials still being valid and the switches being reachable.
Command injection in Brocade SANnav orchestrator versions before 3.0.1a enables network-adjacent attackers to execute arbitrary administrative Fibre Channel switch CLI commands and manipulate container runtimes, achieving high impact on confidentiality, integrity, and availability. The vendor CVSS 4.0 score is 8.6 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H); however, our independent assessment using CVSS 3.1 rates it 8.8 with PR:N (unauthenticated), and the description states unauthenticated while the vector indicates PR:L - authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (CISA KEV).
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-execution/scripting permissions break out of the restricted allow-list execution context and run unauthorized shell commands across managed fabric switches, escalating to full administrative switch access. Exploitation requires a valid SANnav account with scripting rights and adjacency to the SAN management plane (AV:A, PR:L) - the product is not internet-reachable by default - and no user interaction is needed once that foothold exists. Every SANnav release before 3.0.1a is in scope per the CPE (cpe:2.3:a:brocade:sannav:*:*:*:*:*:*:*:*), and no public exploit code has been identified at time of analysis; this is a genuine mid-to-high priority for SANnav operators, not an emergency-tier internet-facing issue.
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate access controls, so a local, non-administrative user on the SANnav host can talk directly to those services and relay commands to interconnected Fabric OS switches under the SANnav management user's identity. Exploitation is access-gated: it requires an authenticated low-privileged account on the host (PR:L, consistent across both the vendor CVSS 4.0 vector and our assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) plus a SANnav instance that is actively managing switches, but where those conditions hold, impact is high across confidentiality, integrity and availability with a changed scope because the attacker's authority crosses from the host user into the managed switch fabric. No public exploit code or confirmed active exploitation was identified at time of analysis.
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Unauthenticated querying of internal management endpoints in Brocade ASCG releases before 3.5.0 discloses the configuration and operating state of the Brocade Fabric OS (FOS) switches that the appliance manages, exposing a customer's SAN fabric topology and switch connectivity attributes. An attacker only needs to be positioned on the same or adjacent management/storage network segment (CVSS AV:A, PR:N, UI:N) to reach those endpoints; no credentials or user interaction are required. Impact is read-only information disclosure with no integrity or availability effect, and no public exploit code or confirmed active exploitation was identified at time of analysis, keeping real-world priority low-to-moderate rather than urgent.
An authenticated path traversal (CWE-22) in the Zone Alias Import flow of Brocade SANnav before 3.0.0a allows an attacker who already holds valid SANnav credentials to write uploaded content outside the intended upload directory, corrupting or planting files on the management host. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confines impact to integrity only, with no confidentiality or availability effect and no user interaction required; per the vendor's CVSS 4.0 vector the attack surface is the management interface reached from an adjacent network segment. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, authenticated file-write issue rather than a top-priority emergency.
Authenticated SQL injection in Brocade SANnav before 3.0.0a allows an attacker with low privileges and adjacent-network access to the SANnav management plane to supply malicious values in specific external API inventory REST API query parameters, which are then used in SQL queries. The vendor rates this as moderate severity with CVSS 4.0 score 6.1; the independent assessment matches an authenticated, adjacent-network profile (PR:L, AV:A, UI:N) with limited confidentiality impact under scope change. No public exploit identified at time of analysis, and no CISA KEV entry is provided.
Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.
OS command injection in the PAM session-cleanup path of Brocade Fabric OS (before 9.2.2d, and 10.0.0 through 10.0.0a1) lets an authenticated user whose directory- or AAA-supplied username or profile identifier contains shell metacharacters execute arbitrary commands as root when their remote SSH session terminates. Three prerequisites must hold simultaneously: the switch must authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than local accounts only, the attacker must be able to set or influence the username/profile identifier in that directory, and the attacker must be able to establish and then close an authenticated SSH session - so switches using only local authentication are not exposed. No public exploit has been identified at time of analysis; vendor-released patch: 9.2.2d for the 9.x branch, with the corresponding fixed 10.0.x release described in the Broadcom/Brocade advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39147.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. Only Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 branch are affected, with a vendor advisory published by Broadcom.
OS command injection in Brocade Fabric OS account management affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated administrator with adjacent management-network access can instigate account deletion, and if the target account has a malformed name containing shell metacharacters-accepted by older Fabric OS builds-the internal cryptographic-key cleanup routine may execute injected commands. This is a medium-severity (CVSS 4.0 base 5.4) issue with low-to-moderate real-world risk because exploitation requires admin privileges, adjacent access, an operator UI action, and the non-default precondition of a pre-existing malformed account name; no public exploit has been identified at time of analysis.
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file and directory deletion in Brocade Fabric OS before 10.0.1 lets an authenticated operator who already holds USB management privileges break out of the intended USB mount point through path manipulation in the REST API USB storage handling and remove files or directories anywhere on the switch local root filesystem. The attack surface is narrow: the interface is reachable only from the adjacent management network (AV:A), requires a high-privileged account (PR:H), and the vendor vector includes an additional attack requirement (AT:P), so this is a trusted-operator or stolen-admin-credential scenario rather than an anonymous remote attack. No public exploit identified at time of analysis; the vendor rates the issue 5.7 under CVSS 4.0 and the independent assessment treats it as a medium-severity, low-to-moderate priority issue that affects integrity only, not an emergency.
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.
Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.
Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.
A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). The result is limited to a denial of service (process crash) with no code execution or data disclosure claimed; there is no CISA KEV listing and no public exploit code identified at time of analysis, and independent assessment rates this as a moderate-priority availability issue rather than a critical one.
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. Impact is limited to confidentiality of the proxy credentials (CVSS 4.0 score 6.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) with no integrity or availability effect, and no public exploit identified at time of analysis.
Brocade Fabric OS releases before 10.0.1 expose an authorization logic flaw in the REST API gateway, where the gate protecting restricted internal management endpoints trusts client-controlled HTTP headers, so any holder of a valid REST session-regardless of privilege level-can spoof those headers and read sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. Exploitation requires an already-authenticated low-privilege REST session (PR:L) and adjacent-network reachability to the gateway (AV:A), and the impact is limited to read-only information disclosure with no integrity or availability effect, consistent with the assessed CVSS 5.1. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a modest-severity issue that is largely contained unless the REST interface is reachable from routed or untrusted networks.
Missing authorization controls in the Brocade Fabric OS REST API on releases before 10.0.1 allow any authenticated API user - regardless of assigned role or administrative scope - to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. The exposure is limited to information disclosure of chassis-wide health metrics, port performance violations, and configuration data; there is no write, code-execution, or availability impact, and the attacker must already hold valid Fabric OS credentials and have adjacent/management-network reachability to the API. There is no public exploit identified at time of analysis, and the issue is best characterized as a modest-priority information disclosure flaw rather than a system-compromise vector.
Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).
Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. Exploitation requires adjacent-network reachability to the management interface (CVSS 4.0 AV:A, PR:N, impact limited to low confidentiality with no integrity or availability effect), and no public exploit code has been identified at time of analysis; the practical risk is concentrated on switches whose management ports are reachable from non-management segments rather than strictly out-of-band networks.
Incomplete property masking in Brocade SANnav's logging subsystem can cause SNMP authentication and privacy passwords to be written into application logs whenever specific configuration conditions are met, so anyone who can read those logs or a generated support bundle can recover the credentials and use them for unauthorized read or management access to the monitored switch environment. The flaw is not remotely exploitable by an unauthenticated attacker: per the available CVSS data (PR:L) and our independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), exploitation requires an actor who already holds log or support-bundle read privileges, and the sensitive values only appear under non-universal configuration conditions. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical risk is a credential-hygiene and information-disclosure exposure realized by insiders or by a post-compromise actor who reuses the recovered SNMP credentials against reachable switches.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and archive protection keys to be written unmasked into application logs and generated support bundles whenever scheduled support-save or related operational jobs execute. An authenticated, low-privileged user who already has read access to those logs or bundles can harvest the credentials and potentially reuse them against remote backup targets or protected archives. This is a confidentiality-only defect rooted in improper log masking (CWE-532), with no public exploit identified at time of analysis; practical impact is LOW-priority because the attacker must already hold log access and the secrets are only exposed after an affected job has actually run.
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Rated high severity (CVSS 7.0). This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 10.4% and no vendor patch available.
A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 24.1% and no vendor patch available.
A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a logged-in user into making administrative changes on the. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00, and 6.0.00a images could allow attackers to cause a denial of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.
The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveraging membership in the operator group. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before. Rated medium severity (CVSS 5.4). No vendor patch available.
The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA. Rated medium severity (CVSS 5.4). No vendor patch available.