PT-2023-23527 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions before 9.2.0 Brocade Fabric OS versions before 9.1.1c Description: An information disclosure in the web interface could allow a remote unauthenticated attacker to get technical details about the web interface...

Brocade Fabric OS Security Vulnerabilities

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. A security vulnerability exists in Brocade Fabric OS versions prior to v9.2.0, which stems from an information disclosure vulnerability in the presence of a web interface...

CVE-2023-31432 Privilege issues in multiple commands

Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0...

CVE-2023-31432 Privilege issues in multiple commands

Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0...

CVE-2023-31432

CVE-2023-31432 enables local privilege escalation in Brocade Fabric OS by abusing commands such as portcfgupload, configupload, license, and myid. The affected product is Brocade Fabric OS (FOS) prior to versions 9.1.1c and 9.2.0, where a non-privileged user could obtain root privileges through m...

CVE-2023-31928

CVE-2023-31928 describes a reflected XSS in Brocade Webtools PortSetting.html of Brocade Fabric OS prior to v9.2.0. An unauthenticated remote attacker could execute arbitrary JavaScript in a target user’s Webtools session. Affected: Fabric OS with Webtools before 9.2.0. Impact: cross-site scripti...

CVE-2023-31928 XSS vulnerability in Brocade Webtools

A reflected cross-site scripting XSS vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target user’s session with the Brocade Webtools...

CVE-2023-31428

CVE-2023-31428 details (Brocade Fabric OS) : A command-line vulnerability affects Brocade Fabric OS prior to 9.1.1c and 9.2.0, enabling a local attacker to dump files from the user’s home directory via grep. The vulnerability, described across multiple sources (NVD/NCSC/Red Hat Red Hat CVE entry)...

CVE-2023-31428 CLI allows upload or transfer files of dangerous types

Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep...

CVE-2023-31428 CLI allows upload or transfer files of dangerous types

Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep...

CVE-2023-31430 buffer overflow vulnerability in “secpolicydelete” command

A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service...

CVE-2023-31430

CVE-2023-31430 describes a buffer overflow in the Brocade Fabric OS CLI command “secpolicydelete.” An authenticated privileged user can trigger a crash of the Fabric OS switch, resulting in a denial of service. The issue affects Brocade Fabric OS before versions 9.1.1c and 9.2.0. The available co...

CVE-2023-31431

CVE-2023-31431 describes a buffer overflow in the Brocade Fabric OS (FOS) diagstatus command. The issue could allow an authenticated user to crash the Brocade Fabric OS switch, resulting in a denial of service. Affected products are Brocade Fabric OS versions prior to v9.2.0 and prior to v9.1.1c....

CVE-2023-31431 A buffer overflow vulnerability in “diagstatus” command

A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service...

CVE-2023-31427

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled...

Command injection

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled...

CVE-2023-31427

CVE-2023-31427 affects Brocade Fabric OS prior to 9.1.1c and 9.2.0, enabling an authenticated local user with knowledge of full path names to execute arbitrary commands with elevated privileges. Root access is disabled from Fabric OS 9.1.0 onward, but prior versions remain vulnerable. Remediation...

CVE-2023-31427 Knowledge of full path name

Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled...

CVE-2023-31426

The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information...

CVE-2023-31426

The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information...