Brocade
100 CVEs across 56 Brocade products. Browse Brocade vulnerabilities, severities, and proof-of-concept exploits.
Brocade products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0869 | High | 8.8 | 2026-03-03 | Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming conf… |
CVE-2025-9711 | High | 7.8 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of s… |
CVE-2025-58381 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sle… |
CVE-2025-58380 | Low | 2.3 | 2026-02-03 | A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path… |
CVE-2026-0383 | High | 7.8 | 2026-02-03 | A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file con… |
CVE-2025-58383 | High | 7.2 | 2026-02-03 | A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and by… |
CVE-2025-58382 | High | 7.2 | 2026-02-03 | A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authentica… |
CVE-2025-58379 | Medium | 5.5 | 2026-02-03 | Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may exp… |
CVE-2025-12774 | High | 7.5 | 2026-02-03 | A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav support save file. An at… |
CVE-2025-12773 | Medium | 6.5 | 2026-02-03 | A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in t… |
CVE-2025-12772 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the… |
CVE-2025-12680 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerab… |
CVE-2025-12679 | Medium | 6.5 | 2026-02-02 | A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption (PBE) key in plaintext in the system audit log file. The vulnerability c… |
CVE-2025-7397 | High | 7.1 | 2025-07-17 | A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the comma… |
CVE-2025-4661 | Low | 2.3 | 2025-06-19 | A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directo… |
CVE-2025-1976 | Medium | 6.7 | 2025-04-24 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with… |
CVE-2024-1509 | Critical | 9.1 | 2025-02-28 | Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the ser… |
CVE-2024-5462 | High | 7.5 | 2025-02-15 | If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be e… |
CVE-2024-5461 | High | 8.0 | 2025-02-15 | Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to… |
CVE-2024-4282 | Critical | 9.8 | 2025-02-15 | Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. |
CVE-2024-10405 | Medium | 5.3 | 2025-02-15 | Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav dat… |
CVE-2024-2240 | High | 7.2 | 2025-02-14 | Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various at… |
CVE-2025-1053 | Medium | 4.9 | 2025-02-14 | Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave… |
CVE-2024-10404 | Medium | 5.5 | 2025-02-14 | CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker… |
CVE-2024-7517 | High | 7.8 | 2024-11-21 | A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated atta… |
CVE-2024-10403 | High | 7.5 | 2024-11-21 | Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmwa… |
CVE-2022-43937 | Medium | 5.7 | 2024-11-21 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Broca… |
CVE-2022-43936 | Medium | 6.8 | 2024-11-21 | Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled. |
CVE-2022-43935 | Medium | 5.3 | 2024-11-21 | An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and autho… |
CVE-2022-43934 | Medium | 6.5 | 2024-11-21 | Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095. |
CVE-2022-43933 | Medium | 4.4 | 2024-11-21 | An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supports… |
CVE-2024-7516 | High | 7.1 | 2024-11-12 | A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise f… |
CVE-2024-5460 | High | 8.1 | 2024-06-26 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow… |
CVE-2024-29954 | Medium | 5.9 | 2024-06-26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fil… |
CVE-2024-29953 | Medium | 4.3 | 2024-06-26 | A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual F… |
CVE-2024-2860 | High | 7.8 | 2024-05-08 | The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM wh… |
CVE-2024-2859 | Medium | 6.8 | 2024-04-27 | By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should… |
CVE-2024-4173 | High | 7.6 | 2024-04-25 | A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, i… |
CVE-2024-4161 | High | 8.6 | 2024-04-25 | In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitiv… |
CVE-2024-4159 | Medium | 4.3 | 2024-04-25 | Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Doc… |
CVE-2024-29969 | High | 7.5 | 2024-04-19 | When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added b… |
CVE-2024-29968 | High | 7.7 | 2024-04-19 | An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mo… |
CVE-2024-29967 | Medium | 4.4 | 2024-04-19 | In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing read… |
CVE-2024-29966 | High | 7.5 | 2024-04-19 | Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerabilit… |
CVE-2024-29965 | Medium | 6.8 | 2024-04-19 | In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The result… |
CVE-2024-29964 | Medium | 5.7 | 2024-04-19 | Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the serv… |
CVE-2024-29962 | Medium | 5.5 | 2024-04-19 | Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without th… |
CVE-2024-29963 | Low | 1.9 | 2024-04-19 | Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries… |
CVE-2024-29961 | High | 8.2 | 2024-04-19 | A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular interva… |
CVE-2024-29960 | Medium | 6.8 | 2024-04-19 | In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnn… |
CVE-2024-29959 | High | 8.6 | 2024-04-19 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support sa… |
CVE-2024-29958 | High | 7.5 | 2024-04-19 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the encryption key in the console when a privileged user executes the script to replace the… |
CVE-2024-29957 | High | 7.5 | 2024-04-19 | When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could pr… |
CVE-2024-29956 | Medium | 6.5 | 2024-04-18 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a switch… |
CVE-2024-29955 | Medium | 5.0 | 2024-04-17 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow a privileged user to print the SANnav encrypted key in PostgreSQL startup logs. This c… |
CVE-2024-29952 | Medium | 5.5 | 2024-04-17 | A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypt… |
CVE-2024-29951 | Medium | 5.7 | 2024-04-17 | Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection. |
CVE-2024-29950 | High | 7.5 | 2024-04-17 | The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could… |
CVE-2023-5973 | Medium | 4.3 | 2024-04-05 | Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved cha… |
CVE-2023-3454 | High | 8.6 | 2024-04-04 | Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to g… |
CVE-2021-27795 | Medium | 6.4 | 2023-12-06 | Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic… |
CVE-2023-4163 | Medium | 4.4 | 2023-08-31 | In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large inp… |
CVE-2023-4162 | Medium | 4.4 | 2023-08-31 | A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This c… |
CVE-2023-31925 | Medium | 5.4 | 2023-08-31 | Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowle… |
CVE-2023-31424 | High | 8.1 | 2023-08-31 | Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization. |
CVE-2023-31423 | Medium | 5.7 | 2023-08-31 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav… |
CVE-2023-3489 | High | 8.6 | 2023-08-31 | The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a… |
CVE-2023-31927 | Medium | 5.3 | 2023-08-02 | An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated… |
CVE-2023-31926 | High | 7.1 | 2023-08-02 | System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0. |
CVE-2023-31928 | Medium | 6.3 | 2023-08-02 | A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0… |
CVE-2023-31432 | High | 7.8 | 2023-08-02 | Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain roo… |
CVE-2023-31431 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to cras… |
CVE-2023-31430 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated priv… |
CVE-2023-31428 | Medium | 5.5 | 2023-08-02 | Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'… |
CVE-2023-31427 | High | 7.8 | 2023-08-01 | Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Broca… |
CVE-2023-31426 | Medium | 6.8 | 2023-08-01 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2023-31425 | High | 7.8 | 2023-08-01 | A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticat… |
CVE-2022-33187 | Medium | 5.5 | 2022-12-09 | Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to re… |
CVE-2022-33186 | Critical | 9.8 | 2022-12-08 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute… |
CVE-2021-27798 | Medium | 5.5 | 2022-08-05 | A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions… |
CVE-2022-27776 | Medium | 6.5 | 2022-06-02 | A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host… |
CVE-2022-27775 | High | 7.5 | 2022-06-02 | An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a… |
CVE-2022-27774 | Medium | 5.7 | 2022-06-02 | An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract creden… |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2022-28161 | Medium | 5.5 | 2022-05-09 | An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to v… |
CVE-2021-22555 | High | 8.3 | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a… |
CVE-2020-13632 | Medium | 5.5 | 2020-05-27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. |
CVE-2020-13631 | Medium | 5.5 | 2020-05-27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. |
CVE-2020-13630 | High | 7.0 | 2020-05-27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. |
CVE-2019-16204 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the… |
CVE-2019-16203 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line… |
CVE-2018-6445 | High | 7.5 | 2019-01-22 | A Vulnerability in Brocade Network Advisor versions before 14.0.3 could allow a remote unauthenticated attacker to export the current user database which inclu… |
CVE-2018-6444 | Critical | 9.8 | 2019-01-22 | A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability cou… |
CVE-2018-6443 | High | 8.1 | 2019-01-22 | A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interfa… |
CVE-2017-6227 | Medium | 6.5 | 2018-02-08 | A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an… |
CVE-2017-6225 | Medium | 6.1 | 2018-02-08 | Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions b… |
CVE-2016-8209 | High | 7.5 | 2017-05-08 | Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is… |
CVE-2016-8207 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remot… |
CVE-2016-8206 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow r… |