Brocade Fabric OS < 9.2.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(299687);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/23");

  script_cve_id("CVE-2025-58379", "CVE-2025-58380");

  script_name(english:"Brocade Fabric OS < 9.2.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Brocade FabricOS host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Brocade FabricOS installed on the remote host is prior to 9.2.1. It is, therefore, affected by multiple
vulnerabilities:

  - Brocade Fabric OS has a vulnerability that could allow a local authenticated attacker to reveal command line
    passwords using commands that may expose higher privilege sensitive information by a lower privileged user.
    (CVE-2025-58379)

  - A vulnerability in Brocade Fabric OS could allow an authenticated attacker with admin privileges using the shell
    command grep to modify the path variables and move upwards in the directory structure or to traverse to different
    directories. (CVE-2025-58380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36850
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b096a7e8");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36854
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc050e6b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Brocade FabricOS 9.2.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-58379");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:brocade:fabric_os");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:broadcom:fabric_operating_system");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("brocade_fabricos_detect.nbin");
  script_require_keys("installed_sw/Brocade FabricOS");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Brocade FabricOS', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '9.2.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);