PT-2025-9137 · Brocade · Brocade Ascg

CVE-2024-1509 · Publicado 2025-02-28 · Atualizado 2026-01-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brocade ASCG versions prior to 3.2.0

Description The issue concerns the lack of HTTP Strict Transport Security (HSTS) enforcement in the web interface, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The absence of HSTS allows for downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Recommendations For Brocade ASCG versions prior to 3.2.0, update to version 3.2.0 or later to enforce HSTS and mitigate the risk of downgrade attacks and SSL-stripping man-in-the-middle attacks. As a temporary workaround, consider configuring the server to instruct the browser to only communicate via HTTPS until a patch is available.

Correção

Enumeração de Fraquezas

CWE-523

Identificadores relacionados

CVE-2024-1509

Produtos afetados

Brocade Ascg

Referências · 7

• https://t.me/cvedetector/19189 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1896217909644410998 · Publicação no Twitter
• https://t.me/cveNotify/150236 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-1509 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-1509 · Nota de Segurança
• https://twitter.com/CVEnew/status/1895619294249242976 · Publicação no Twitter
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428 · Nota