Fabric Os
Monthly
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-adjacent attacker reach an unprotected endpoint in the web management interface's Single Sign-On workflow and obtain administrative access to the device. No credentials or user interaction are required (PR:N/UI:N), although High attack complexity (AC:H) means conditions outside the attacker's control must line up for reliable exploitation, and exposure is confined to MXG610 deployments with a reachable management interface. No public exploit code has been identified at the time of analysis, and there is no confirmation of active exploitation.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Privilege escalation in Brocade Fabric OS (versions before 10.0.1) allows a low-privilege authenticated account to obtain root-equivalent chassis administrative access when the switch is configured to use an external AAA identity source. The switch fails to constrain crafted Vendor-Specific Attributes or directory claims returned by RADIUS, LDAP, TACACS+, or a Federated IdP against its administrative role restrictions during session establishment, so an attacker who can influence those returned attributes is granted full control. Exploitation is conditional rather than mass-scale: it requires external AAA integration to be configured (deployments using only local authentication are unaffected), a valid low-privilege account (CVSS PR:L), management-network adjacency (AV:A), and attacker influence over IdP-returned attributes (AT:P); no public exploit code was identified at time of analysis, and vendor-released patch version 10.0.1 is available.
Brocade Fabric OS Management Server before version 10.0.1 can be manipulated by a compromised or rogue Fibre Channel switch that is already trusted within the fabric, which uses crafted inband vendor-unique Common Transport (CT) management requests to bypass administrative authentication. This lets the unauthorized peer perform sensitive administrative actions on the target device, including resetting administrative passwords, rebooting the system, and initiating firmware downloads. The attack is confined to the Fibre Channel fabric and cannot be launched from the management IP network or the internet; it requires a pre-compromised fabric peer (assessed AV:A/AC:H with an AT:P precondition in the vendor vector), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Read-only management accounts on Brocade Fabric OS switches can escalate to restricted administrative operations by submitting management-protocol requests whose non-standard action opcodes the RBAC validation engine mis-categorizes during its permission check; the flaw affects Fabric OS releases before 10.0.1 and is scored CVSS 4.0 base 7.1 (CWE-269, improved privilege management failure). Exploitation is gated: an attacker must already hold a valid authenticated read-only management account (PR:L) and be positioned on an adjacent/management network (AV:A) to reach the affected management plane, with no user interaction required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so practical risk is driven by the attacker's existing credentials and management-network access rather than by remote unauthenticated reachability.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.
OS command injection in the PAM session-cleanup path of Brocade Fabric OS (before 9.2.2d, and 10.0.0 through 10.0.0a1) lets an authenticated user whose directory- or AAA-supplied username or profile identifier contains shell metacharacters execute arbitrary commands as root when their remote SSH session terminates. Three prerequisites must hold simultaneously: the switch must authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than local accounts only, the attacker must be able to set or influence the username/profile identifier in that directory, and the attacker must be able to establish and then close an authenticated SSH session - so switches using only local authentication are not exposed. No public exploit has been identified at time of analysis; vendor-released patch: 9.2.2d for the 9.x branch, with the corresponding fixed 10.0.x release described in the Broadcom/Brocade advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39147.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. Only Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 branch are affected, with a vendor advisory published by Broadcom.
OS command injection in Brocade Fabric OS account management affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated administrator with adjacent management-network access can instigate account deletion, and if the target account has a malformed name containing shell metacharacters-accepted by older Fabric OS builds-the internal cryptographic-key cleanup routine may execute injected commands. This is a medium-severity (CVSS 4.0 base 5.4) issue with low-to-moderate real-world risk because exploitation requires admin privileges, adjacent access, an operator UI action, and the non-default precondition of a pre-existing malformed account name; no public exploit has been identified at time of analysis.
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file and directory deletion in Brocade Fabric OS before 10.0.1 lets an authenticated operator who already holds USB management privileges break out of the intended USB mount point through path manipulation in the REST API USB storage handling and remove files or directories anywhere on the switch local root filesystem. The attack surface is narrow: the interface is reachable only from the adjacent management network (AV:A), requires a high-privileged account (PR:H), and the vendor vector includes an additional attack requirement (AT:P), so this is a trusted-operator or stolen-admin-credential scenario rather than an anonymous remote attack. No public exploit identified at time of analysis; the vendor rates the issue 5.7 under CVSS 4.0 and the independent assessment treats it as a medium-severity, low-to-moderate priority issue that affects integrity only, not an emergency.
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.
Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.
Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.
A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). The result is limited to a denial of service (process crash) with no code execution or data disclosure claimed; there is no CISA KEV listing and no public exploit code identified at time of analysis, and independent assessment rates this as a moderate-priority availability issue rather than a critical one.
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. Impact is limited to confidentiality of the proxy credentials (CVSS 4.0 score 6.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) with no integrity or availability effect, and no public exploit identified at time of analysis.
Brocade Fabric OS releases before 10.0.1 expose an authorization logic flaw in the REST API gateway, where the gate protecting restricted internal management endpoints trusts client-controlled HTTP headers, so any holder of a valid REST session-regardless of privilege level-can spoof those headers and read sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. Exploitation requires an already-authenticated low-privilege REST session (PR:L) and adjacent-network reachability to the gateway (AV:A), and the impact is limited to read-only information disclosure with no integrity or availability effect, consistent with the assessed CVSS 5.1. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a modest-severity issue that is largely contained unless the REST interface is reachable from routed or untrusted networks.
Missing authorization controls in the Brocade Fabric OS REST API on releases before 10.0.1 allow any authenticated API user - regardless of assigned role or administrative scope - to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. The exposure is limited to information disclosure of chassis-wide health metrics, port performance violations, and configuration data; there is no write, code-execution, or availability impact, and the attacker must already hold valid Fabric OS credentials and have adjacent/management-network reachability to the API. There is no public exploit identified at time of analysis, and the issue is best characterized as a modest-priority information disclosure flaw rather than a system-compromise vector.
Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).
Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. Exploitation requires adjacent-network reachability to the management interface (CVSS 4.0 AV:A, PR:N, impact limited to low confidentiality with no integrity or availability effect), and no public exploit code has been identified at time of analysis; the practical risk is concentrated on switches whose management ports are reachable from non-management segments rather than strictly out-of-band networks.
Authentication bypass in Brocade Fabric OS versions before 9.2.2d running on the MXG610 extension switch lets a network-adjacent attacker reach an unprotected endpoint in the web management interface's Single Sign-On workflow and obtain administrative access to the device. No credentials or user interaction are required (PR:N/UI:N), although High attack complexity (AC:H) means conditions outside the attacker's control must line up for reliable exploitation, and exposure is confined to MXG610 deployments with a reachable management interface. No public exploit code has been identified at the time of analysis, and there is no confirmation of active exploitation.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Privilege escalation in Brocade Fabric OS (versions before 10.0.1) allows a low-privilege authenticated account to obtain root-equivalent chassis administrative access when the switch is configured to use an external AAA identity source. The switch fails to constrain crafted Vendor-Specific Attributes or directory claims returned by RADIUS, LDAP, TACACS+, or a Federated IdP against its administrative role restrictions during session establishment, so an attacker who can influence those returned attributes is granted full control. Exploitation is conditional rather than mass-scale: it requires external AAA integration to be configured (deployments using only local authentication are unaffected), a valid low-privilege account (CVSS PR:L), management-network adjacency (AV:A), and attacker influence over IdP-returned attributes (AT:P); no public exploit code was identified at time of analysis, and vendor-released patch version 10.0.1 is available.
Brocade Fabric OS Management Server before version 10.0.1 can be manipulated by a compromised or rogue Fibre Channel switch that is already trusted within the fabric, which uses crafted inband vendor-unique Common Transport (CT) management requests to bypass administrative authentication. This lets the unauthorized peer perform sensitive administrative actions on the target device, including resetting administrative passwords, rebooting the system, and initiating firmware downloads. The attack is confined to the Fibre Channel fabric and cannot be launched from the management IP network or the internet; it requires a pre-compromised fabric peer (assessed AV:A/AC:H with an AT:P precondition in the vendor vector), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Read-only management accounts on Brocade Fabric OS switches can escalate to restricted administrative operations by submitting management-protocol requests whose non-standard action opcodes the RBAC validation engine mis-categorizes during its permission check; the flaw affects Fabric OS releases before 10.0.1 and is scored CVSS 4.0 base 7.1 (CWE-269, improved privilege management failure). Exploitation is gated: an attacker must already hold a valid authenticated read-only management account (PR:L) and be positioned on an adjacent/management network (AV:A) to reach the affected management plane, with no user interaction required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so practical risk is driven by the attacker's existing credentials and management-network access rather than by remote unauthenticated reachability.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.
OS command injection in the PAM session-cleanup path of Brocade Fabric OS (before 9.2.2d, and 10.0.0 through 10.0.0a1) lets an authenticated user whose directory- or AAA-supplied username or profile identifier contains shell metacharacters execute arbitrary commands as root when their remote SSH session terminates. Three prerequisites must hold simultaneously: the switch must authenticate users against an external directory or AAA service (LDAP/RADIUS/TACACS+) rather than local accounts only, the attacker must be able to set or influence the username/profile identifier in that directory, and the attacker must be able to establish and then close an authenticated SSH session - so switches using only local authentication are not exposed. No public exploit has been identified at time of analysis; vendor-released patch: 9.2.2d for the 9.x branch, with the corresponding fixed 10.0.x release described in the Broadcom/Brocade advisory at https://support.broadcom.com/external/content/SecurityAdvisories/0/39147.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Malformed Apache configuration data accepted by Brocade Fabric OS during web management service setup or re-initialization can corrupt the stored configuration and prevent the administrative web interface from starting or recovering, producing a persistent denial of service that recurs on each service bring-up. Exploitation requires an attacker who already holds high administrative privileges on the switch and can reach it from an adjacent network segment (assessed CVSS:3.1 AV:A/AC:L/PR:H/UI:N, availability-only impact), and no public exploit code was identified at time of analysis. Only Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 branch are affected, with a vendor advisory published by Broadcom.
OS command injection in Brocade Fabric OS account management affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated administrator with adjacent management-network access can instigate account deletion, and if the target account has a malformed name containing shell metacharacters-accepted by older Fabric OS builds-the internal cryptographic-key cleanup routine may execute injected commands. This is a medium-severity (CVSS 4.0 base 5.4) issue with low-to-moderate real-world risk because exploitation requires admin privileges, adjacent access, an operator UI action, and the non-default precondition of a pre-existing malformed account name; no public exploit has been identified at time of analysis.
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file and directory deletion in Brocade Fabric OS before 10.0.1 lets an authenticated operator who already holds USB management privileges break out of the intended USB mount point through path manipulation in the REST API USB storage handling and remove files or directories anywhere on the switch local root filesystem. The attack surface is narrow: the interface is reachable only from the adjacent management network (AV:A), requires a high-privileged account (PR:H), and the vendor vector includes an additional attack requirement (AT:P), so this is a trusted-operator or stolen-admin-credential scenario rather than an anonymous remote attack. No public exploit identified at time of analysis; the vendor rates the issue 5.7 under CVSS 4.0 and the independent assessment treats it as a medium-severity, low-to-moderate priority issue that affects integrity only, not an emergency.
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.
Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.
Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.
A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). The result is limited to a denial of service (process crash) with no code execution or data disclosure claimed; there is no CISA KEV listing and no public exploit code identified at time of analysis, and independent assessment rates this as a moderate-priority availability issue rather than a critical one.
Cleartext storage of HTTP proxy credentials in Brocade Fabric OS SupportLink diagnostic support bundles (all versions before 10.0.1) lets anyone who can read a generated bundle recover the proxy account's username and password. The issue is access-gated rather than network-reachable: it only manifests when SupportLink is configured to use an authenticated HTTP proxy, and the attacker must already have read access to the bundle, either as support personnel handling it or as a user able to reach the file share where bundles are retained. Impact is limited to confidentiality of the proxy credentials (CVSS 4.0 score 6.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:N) with no integrity or availability effect, and no public exploit identified at time of analysis.
Brocade Fabric OS releases before 10.0.1 expose an authorization logic flaw in the REST API gateway, where the gate protecting restricted internal management endpoints trusts client-controlled HTTP headers, so any holder of a valid REST session-regardless of privilege level-can spoof those headers and read sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. Exploitation requires an already-authenticated low-privilege REST session (PR:L) and adjacent-network reachability to the gateway (AV:A), and the impact is limited to read-only information disclosure with no integrity or availability effect, consistent with the assessed CVSS 5.1. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a modest-severity issue that is largely contained unless the REST interface is reachable from routed or untrusted networks.
Missing authorization controls in the Brocade Fabric OS REST API on releases before 10.0.1 allow any authenticated API user - regardless of assigned role or administrative scope - to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. The exposure is limited to information disclosure of chassis-wide health metrics, port performance violations, and configuration data; there is no write, code-execution, or availability impact, and the attacker must already hold valid Fabric OS credentials and have adjacent/management-network reachability to the API. There is no public exploit identified at time of analysis, and the issue is best characterized as a modest-priority information disclosure flaw rather than a system-compromise vector.
Improper neutralization of CRLF sequences in the Federated Authentication (FA) configuration of Brocade Fabric OS before 10.0.1 lets an authenticated administrator - or anyone able to supply a crafted FA configuration file that an operator imports - inject arbitrary web server directives through the Identity Provider (IdP) issuer parameter, which can prevent the web management daemon from starting (denial of service) or alter web server security controls. Exploitation is heavily constrained: the target must run a vulnerable Fabric OS release with FA actually in use, the attacker needs administrative privilege (CVSS PR:H) and adjacent-network access to the management interface (AV:A), with no user interaction otherwise required, and no public exploit code has been identified at time of analysis. This is a medium-severity, operator-dependent flaw rather than a top-priority emergency, and it is not confirmed actively exploited (CISA KEV).
Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. Exploitation requires adjacent-network reachability to the management interface (CVSS 4.0 AV:A, PR:N, impact limited to low confidentiality with no integrity or availability effect), and no public exploit code has been identified at time of analysis; the practical risk is concentrated on switches whose management ports are reachable from non-management segments rather than strictly out-of-band networks.