CVE-2023-3489
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade to any earlier version of Fabric OS.
Risk Assessment
Logging the password in clear text poses a risk of unauthorized access to the server, potentially leading to serious data security breaches.
Recommendation
It is recommended to avoid using the firmwaredownload command for downgrades in version v9.2.0 and to monitor and secure SupportSave files.
Other vulnerabilities in Brocade Fabric OS v9.2.0
See all- CVE-2023-4163Medium
In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.
- CVE-2023-4162Medium
A segmentation fault can occur in Brocade Fabric OS after version 9.0 and before version 9.2.0a through the passwdcfg command. This allows an authenticated privileged local user to crash a Brocade Fabric OS switch.
Original NVD description (English source)
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.