Brocade Fabric OS vulnerabilities

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads can overflow stack buffers, causing a crash of the weblinker daemon.

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges.

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.

An OS command injection vulnerability exists in the PAM session cleanup routines during SSH session termination on Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges.

A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root.

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user can bypass authorization restrictions and assign administrative roles to a target account, leading to localized privilege escalation.

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine, and malformed account names can cause the execution of embedded shell metacharacters.

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames, the receiving switch processes them at an elevated level without proper verification. An attacker on a single fabric-connected switch can escalate privileges and execute arbitrary root commands locally or across other managed fabric members.

In Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1, handling of specific download protocols uses unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed via a shell. Because control characters and shell metacharacters are not stripped, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure can prevent the web management service from starting or recovering, leading to a persistent Denial of Service (DoS).

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, the race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS before 10.0.1. An authenticated user with USB management privileges can manipulate target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

A logic vulnerability in Brocade Fabric OS before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. User-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can execute arbitrary system commands with the privileges of the underlying management daemon. Affects versions before 9.2.2d and 10.0.0 through 10.0.0a1.

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this by submitting a crafted request with an arbitrary fabric identifier. This allows unauthorized cross-fabric operations and viewing configuration details within tenants/Virtual Fabrics to which they have not been granted access.

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can submit a crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent DoS, critical system file destruction, host compromise, or sensitive data leakage.

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon relays configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters, a malicious or compromised configuration file can cause arbitrary OS commands to be executed on a remote local switch when an administrator initiates a configuration download.

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal IPC channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this by supplying crafted parameters, resulting in arbitrary OS command execution with root privileges.

An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.

An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations.

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.

A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.

Vulnerability in the Brocade Fabric OS management interface before version 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the IdP issuer parameter, allowing an administrator or attacker to inject arbitrary web server directives. This can lead to denial of service or alteration of web server security controls.

Stack-based buffer overflow in the security library component of Brocade Fabric OS before version 10.0.1. When parsing uploaded X.509 PEM certificates, the system improperly validates the AKI extension length before copying data. An authenticated administrator can supply a certificate with an oversized AKI extension, leading to memory corruption and management daemon crash.

Information disclosure vulnerability in SupportLink diagnostic utilities in Brocade Fabric OS before version 10.0.1. When SupportLink is configured with an authenticated HTTP proxy, the system stores the full proxy URL. Individuals with access to diagnostic bundles can extract cleartext proxy credentials.

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

Authorization logic vulnerability in the REST API gateway of Brocade Fabric OS before version 10.0.1. The internal gate for restricted management endpoints relies solely on client-controlled HTTP headers. An authenticated user can spoof these headers to gain unauthorized access to internal management endpoints, including hardware data and audit logs.

Missing authorization check in the REST API interface of Brocade Fabric OS before version 10.0.1. An authenticated user, regardless of role, can retrieve complete MAPS violation data across all logical switches. An attacker with low privileges can access system health, port performance, and configuration data.

Stack-based buffer overflow in the diagnostic execution utility of Brocade Fabric OS before version 10.0.1. When processing command arguments, the utility tokenizes input without enforcing array boundary checks. An authenticated administrator can supply excessive arguments, leading to memory overwrite and process crash.

Stack-based buffer overflow in the IKEv2 protocol handler on Brocade Fabric OS before version 10.0.1. When processing initial key exchange requests on extension switches with FCIP, an unauthenticated remote attacker can send a single UDP packet with an oversized Nonce field, causing a data-plane process crash.

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

An access control bypass vulnerability exists in the RBAC validation engine of Brocade Fabric OS before 10.0.1. The RBAC engine incorrectly categorizes non-standard action opcodes during permission checks, allowing authenticated read-only users to execute restricted administrative operations.

A command injection vulnerability in the REST API management interface of Brocade Fabric OS before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

A heap overflow vulnerability exists in Brocade Fabric OS before 10.0.1 when processing trunk configuration operations. The application parses user-supplied list strings into dynamically allocated heap arrays without boundary checks, allowing an authenticated administrator to cause heap corruption via crafted REST API requests.

In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.

A segmentation fault can occur in Brocade Fabric OS after version 9.0 and before version 9.2.0a through the passwdcfg command. This allows an authenticated privileged local user to crash a Brocade Fabric OS switch.

The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade to any earlier version of Fabric OS.