RCE in Broadcom Brocade 6547
CVE-2024-5461
Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (38.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Broadcom Brocade 6547
- Broadcom Fabric Operating System
- Brocade Fabric OS — versions before 8.2.3e1_pha
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-5461?
- CVE-2024-5461 is a high-severity vulnerability in Broadcom Brocade 6547, classified under OS Command Injection. CVSS score: 8.0/10. Published 2025-02-15.
- How severe is CVE-2024-5461?
- High severity. CVSS v3 base score is 8.0 out of 10.