Broadcom Fabric Operating System vulnerabilities

CVE-2026-0383 [HIGH] CWE-78 CVE-2026-0383: A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file contents including the history command.

CVE-2025-58383 [HIGH] CWE-250 CVE-2025-58383: A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands.

CVE-2025-58382 [HIGH] CWE-305 CVE-2025-58382: A vulnerability in the secure configuration of authentication and management services in Brocade Fa A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands as root using “supportsave”, “seccertmgmt”, “configupload” command.

CVE-2025-9711 [HIGH] CWE-272 CVE-2025-9711: A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the loca A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.

CVE-2025-58381 [MEDIUM] CWE-35 CVE-2025-58381: A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with adm A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sleep, disown, wait to modify the path variables and move upwards in the directory structure or to traverse to different directories.

CVE-2025-58380 [MEDIUM] CWE-35 CVE-2025-58380: A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin p A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path variables and move upwards in the directory structure or to traverse to different directories.

CVE-2025-58379 [MEDIUM] CWE-250 CVE-2025-58379: Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker t Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.

CVE-2025-4663 [MEDIUM] CWE-754 CVE-2025-4663: An Improper Check for Unusual or Exceptional Conditions vulnerability in Brocade Fabric OS before 9 An Improper Check for Unusual or Exceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a could allow an authenticated, network-based attacker to cause a Denial-of-Service (DoS). The vulnerability is encountered when supportsave is invoked remotely, using ssh command or SANnav inline ssh, and the corresponding ssh session is terminated

CVE-2025-4661 [MEDIUM] CWE-22 CVE-2025-4661: A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directory potentially leading to the disclosure of sensitive information. Note: Admin level privilege is required on the switch in order to exploit

CVE-2025-1976 [HIGH] CWE-94 CVE-2025-1976: Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.

CVE-2024-5461 [HIGH] CWE-78 CVE-2024-5461: Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC50 Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. Th

CVE-2024-5462 [MEDIUM] CWE-319 CVE-2024-5462: If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passw If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsave capture if encryption of passwords is not enabled. An attacker can use these passwords to f

CVE-2024-7517 [HIGH] CWE-78 CVE-2024-7517: A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only possible on IP Extension platforms: Brocade 7810, Brocade 7840, Brocade 7850 and

CVE-2024-10403 [MEDIUM] CWE-528 CVE-2024-10403: Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.

CVE-2024-7516 [HIGH] CWE-322 CVE-2024-7516: A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers t A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a switch admin.

CVE-2024-5460 [HIGH] CWE-798 CVE-2024-5460: A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) featu A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to hard-coded, default community string in the configuration file for the SNMP daemon. An a

CVE-2024-29954 [MEDIUM] CWE-312 CVE-2024-29954: A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the firmwaredownload command is incorrectly entered or points to an er

CVE-2024-29953 [MEDIUM] CWE-922 CVE-2024-29953: A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords.

CVE-2023-5973 [MEDIUM] CWE-346 CVE-2023-5973: Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display.

CVE-2023-3454 [HIGH] CWE-78 CVE-2023-3454: Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could al Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch.