RCE in Broadcom Brocade 6547
CVE-2024-5461
Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (36.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Broadcom Brocade_6547
- Broadcom Fabric_operating_system
- Brocade Fabric Os — versions before 8.2.3e1_pha
Weakness classification (CWE)
References
- sirt@brocade.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-5461?
- CVE-2024-5461 is a high-severity vulnerability in Broadcom Brocade 6547, classified under OS Command Injection. CVSS score: 8.0/10. Published 2025-02-15.
- How severe is CVE-2024-5461?
- High severity. CVSS v3 base score is 8.0 out of 10.