CVE-2021-27790: The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string function to process user…

PriorityP342high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.46%

36.3th percentile

The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string function to process user input. Authenticated attackers can abuse this vulnerability to exploit stack-based buffer overflows, allowing execution of arbitrary code as the root user account.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
broadcom	fabric_operating_system	< 7.4.2h	7.4.2h
broadcom	fabric_operating_system	>= 8.0.0 < 8.2.0_cbn4	8.2.0_cbn4
broadcom	fabric_operating_system	>= 8.2.1 < 8.2.3	8.2.3
broadcom	fabric_operating_system	>= 9.0.0 < 9.0.1a	9.0.1a

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.