CVE-2024-29954

CVE-2024-29954 affects Brocade Fabric OS. The issue is a password management API that prints sensitive information to logs when the firmwaredownload command is used with an erroneous file or input, allowing an authenticated user to view server passwords for SCP/SFTP. Root cause: the failed firmwa...

CVE-2021-27789

CVE-2021-27789 affects Brocade Fabric OS web app and CLI on Brocade Fabric OS versions prior to v9.0.1a and v8.2.3a. The issue stems from debug statements that print sensitive information to stdout, enabling an attacker who has already compromised the FOS system to capture credentials and other s...

CVE-2021-27796

The CVE-2021-27796 issue affects Brocade Fabric OS prior to versions that include fixed releases v8.0.1b and v7.4.1d. An authenticated user in the restricted shell (rbash) on the user or factory account can read arbitrary files on the filesystem by leveraging one of several binaries, enabling pot...

CVE-2022-28170

CVE-2022-28170 affects Brocade Fabric OS Web Application services, exposing stored passwords in debug statements across multiple firmware lines (before v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j). The underlying issue is that server and user credentials are logged in debug output, enabling a local attacke...

CVE-2023-31426

The CVE-2023-31426 issue affects Brocade Fabric OS where the commands configupload and configdownload, on certain older Fabric OS versions, print scp, sftp, and ftp server passwords in the supportsave data. Root cause is exposure of passwords in supportsave output when using those commands prior ...

CVE-2022-33185

CVE-2022-33185 affects Brocade Fabric OS prior to 9.0.1e and version 9.1.0. The root cause is the use of unsafe string functions to process user input in several commands, which can cause stack-based buffer overflows. An authenticated local attacker could exploit this to execute arbitrary code as...

CVE-2024-10403

CVE-2024-10403 affects Brocade Fabric OS: versions prior to 8.2.3e2, 9.0.0–9.2.0c, and 9.2.1–9.2.1a may capture the SFTP/FTP server password used for firmware downloads when SANnav or WebEM triggers a weblinker core dump later uploaded via SupportSave. Root cause: sensitive credentials stored in ...

CVE-2024-5462

Brocade Fabric OS vulnerable before 9.2.0 when SNMP password encryption is not configured. The SNMP privsecret and authsecret can be exposed in plaintext in configupload or supportsave captures, enabling an attacker to use SNMPv3 to retrieve OID values and potentially modify a limited set of MIB ...

CVE-2024-5460

CVE-2024-5460 affects Brocade Fabric OS versions before 9.0.0, where a hard-coded, default SNMP community string in the SNMP daemon config enables an authenticated, remote attacker to read data from the device. Exploitation via SNMP v1 with the static community string is implied; the vulnerabilit...

CVE-2022-33178

The CVE-2022-33178 entry affects Brocade Fabric OS prior to 9.0, where a vulnerability in the radius authentication system could allow a remote attacker to execute arbitrary code on Brocade switches. The root cause is improper input validation of the Brocade-Auth-Role parameter, enabling code exe...

CVE-2022-33179

CVE-2022-33179 affects Brocade Fabric OS CLI before versions v9.1.0, v9.0.1e, v8.2.3c, and v7.4.2j. The issue allows a local authenticated user to escape restricted shells using the command “set context” and perform privilege escalation. Affected product: Brocade Fabric OS CLI. Root cause: improp...

CVE-2019-16204

The CVE-2019-16204 issue affects Brocade Fabric OS prior to versions 7.4.2f, 8.2.2a, 8.1.2j, and 8.2.1d. The vulnerability allows exposure of external passwords, common secrets, or authentication keys used between the switch and an external server. Root cause: information disclosure via insecure ...

CVE-2021-27794

CVE-2021-27794 affects Brocade Fabric OS prior to versions fixed in Brocade/Fabric OS advisories. The vulnerability arises in the authentication mechanism, allowing login with an empty or invalid password via telnet, ssh, and REST. Affected products include Brocade Fabric OS versions before v9.0....

CVE-2022-33183

CVE-2022-33183 describes a stack buffer overflow in the Brocade Fabric OS CLI. The vulnerability affects Brocade Fabric OS Command Line Interface prior to versions v9.1.0, v9.0.1e, v8.2.3c, v8.2.0cbn5, and v7.4.2.j, enabling a remote authenticated attacker to trigger a stack overflow via the firm...

CVE-2022-33181

CVE-2022-33181 affects Brocade Fabric OS CLI. The flaw in the CLI could allow a local authenticated attacker to read sensitive files via switch commands configshow and supportlink. Affected versions include Brocade Fabric OS before v9.1.0, and specific builds v9.0.1e, v8.2.3c, v8.2.0cbn5, and v7....

CVE-2022-33184

The vulnerability CVE-2022-33184 affects Brocade Fabric OS via the fab_seg.c.h libraries, with all prior-FOS versions vulnerable to a stack-based buffer overflow that could let a local authenticated attacker execute arbitrary code as root. Affected platforms include Fabric OS releases prior to 9....

CVE-2023-31427

CVE-2023-31427 affects Brocade Fabric OS prior to 9.1.1c and 9.2.0, enabling an authenticated local user with knowledge of full path names to execute arbitrary commands with elevated privileges. Root access is disabled from Fabric OS 9.1.0 onward, but prior versions remain vulnerable. Remediation...

CVE-2017-6227

CVE-2017-6227 affects Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS). The IPv6 stack vulnerability allows a remote attacker to cause a denial-of-service (CPU consumption and device hang) by sending crafted Router Advertisement messages. Affected FOS versions include pre-7.4.2b...

CVE-2020-15387

The CVE-2020-15387 entry concerns Brocade Fabric OS hosts whose SSH servers (and SANnav) used keys

CVE-2020-15388

CVE-2020-15388 affects Brocade Fabric OS; an authenticated CLI user can abuse the history command to write arbitrary content to files in vulnerable builds. Affected OS versions include Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h. Confirmed by multiple sources (Red Hat, Broadcom ad...

CVE-2020-15375

The vulnerability CVE-2020-15375 affects Brocade Fabric OS (FOS) prior to targeted versions (v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g). It is an input validation weakness in the command-line interface when secccrypptocfg is invoked, allowing a local authenticated user to run arbitr...

CVE-2023-31429

CVE-2023-31429 affects Brocade Fabric OS prior to 9.1.1c and 9.2.0. A set of CLI commands (e.g., chassisdistribute, reboot, rasman, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable, supportshowcfgenable) can cause the contents of shell interpreted variables to be printed...

CVE-2020-15383

CVE-2020-15383 affects Brocade Fabric OS firmware where running security scans can cause memory exhaustion in the config and secnotify processes, leading to denial of service and potential switch panic. Affected firmware versions include before v9.0.0, v8.2.2d, and v8.2.1e. The issue is described...

CVE-2020-15372

Summary: CVE-2020-15372 affects the Brocade Fabric OS command-line interface. An authenticated local attacker could modify shell variables, potentially causing privilege escalation or logging bypass. Affected products/versions (as detailed in connected sources): Brocade Fabric OS CLI on Fabric OS...

CVE-2018-6449

CVE-2018-6449 is a Host Header Injection vulnerability in the http management interface of Brocade Fabric OS. The issue affects Fabric OS versions before v9.0.0, allowing a remote attacker to inject arbitrary HTTP headers via the management interface. The Red Hat/Red Hat-linked entry and Broadcom...

CVE-2017-6225

CVE-2017-6225 affects Brocade Fabric OS Web GUI: cross-site scripting due to improper input validation in the web-based management interface. A remote attacker could execute arbitrary script in a victim’s browser or access sensitive information. Affected products include Brocade Fibre Channel SAN...

CVE-2024-5461

CVE-2024-5461 affects Brocade Fabric OS on the Brocade 6547 (FC5022) embedded switch blade. The SNMP implementation makes internal script calls to system.sh, allowing an authenticated attacker to injection commands/parameters and potentially execute as root. Affected behavior is the SNMP operatio...

CVE-2021-27792

CVE-2021-27792 affects Brocade Fabric OS with a flaw in the web management interface: input validation failure for malformed requests can crash the FOS HTTP application handler, causing a DoS and reboot requirement. Affected products include Brocade Fabric OS versions before 9.0.1a, 8.2.3a, and 7...

CVE-2023-4163

CVE-2023-4163 : In Brocade Fabric OS before v9.2.0a, a locally authenticated privileged user can trigger a buffer overflow in the portcfgfportbuffers command, leading to a kernel panic due to large input buffers. This is confirmed by multiple sources in the connected documents (NVD entry, Red Hat...

CVE-2021-27790

The issue (CVE-2021-27790) affects Brocade Fabric OS and centers on the ipfilter command. The vulnerability arises from the use of an unsafe string function to process user input, enabling stack-based buffer overflows. Exploitation requires authentication and leads to the possibility of arbitrary...

CVE-2024-7516

CVE-2024-7516 affects Brocade Fabric OS versions before 9.2.2. The vulnerability arises from the ability to forge SSH keys during remote operations initiated by a switch admin, enabling man-in-the-middle remote service session hijacking. Impact is described as high for confidentiality, integrity,...

CVE-2018-6448

CVE-2018-6448 involves a vulnerability in the management interface of Brocade Fabric OS. The issue could allow a remote attacker to cause a denial of service on the vulnerable host when exploiting the management interface, with affected versions being Brocade Fabric OS releases prior to v9.0.0. P...

CVE-2021-27795

CVE-2021-27795 affects Brocade Fabric OS (FOS) on hardware platforms that support the license string format. The issue stems from cryptographic weaknesses that could allow forged or fraudulent license keys to be accepted and activated as legitimate. The affected software is described as any versi...

CVE-2026-0383

CVE-2026-0383 : A vulnerability in Brocade Fabric OS allows an authenticated, local attacker with privileges to access the Bash shell and read insecurely stored files, including command history. Affected releases include Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a, and 10.0.0. Remediation/m...

CVE-2020-15370

CVE-2020-15370 affects Brocade Fabric OS before v7.4.2g. Documents show an information disclosure where an authenticated, remote attacker could view a user password in cleartext due to incorrect logging of passwords in log files. Impact is information disclosure with access to passwords, requirin...

CVE-2025-9711

CVE-2025-9711 is a local privilege escalation flaw in Brocade Fabric OS prior to 9.2.1c3, enabling a local authenticated user to elevate privileges to root via the export option of the seccertmgmt and seccryptocfg commands. Connected sources confirm affected software versions and the root-cause i...

CVE-2025-58381

CVE-2025-58381 affects Brocade Fabric OS prior to 9.2.1c2. An authenticated admin can use shell commands (source, ping6, sleep, disown, wait) to modify path variables and traverse directories (directory transversal). Public docs consistently name Brocade Fabric OS and versions up to 9.2.1c2 as af...

CVE-2025-58379

CVE-2025-58379 affects Brocade Fabric OS prior to 9.2.1, enabling a local authenticated attacker to reveal command-line passwords by exploiting commands that may expose higher-privilege sensitive information to a lower-privileged user. Connected sources confirm the vulnerable software as Brocade ...

CVE-2025-58383

CVE-2025-58383 : Brocade Fabric OS before 9.2.1c2 contains a privilege-escalation flaw where an administrator-level user can abuse the bind command to bypass security controls and execute arbitrary commands. The issue is documented across multiple sources (NVD/Red Hat/Broadcom advisories) with th...

CVE-2025-58382

CVE-2025-58382 concerns Brocade Fabric OS prior to 9.2.1c2, where an authenticated remote attacker with administrative credentials could execute arbitrary commands as root via the supportsave, seccertmgmt, and configupload interfaces. The vulnerability arises from insecure configuration of authen...

CVE-2025-58380

Brocade Fabric OS prior to 9.2.1 is affected by CVE-2025-58380, a local directory traversal issue exploitable by an authenticated admin using the shell grep command to modify PATH, enabling traversal to higher directories. Multiple connected sources (Red Hat, NVD, Broadcom advisories) corroborate...