PT-2021-4506 · Brocade · Brocade Fabric Os

Published 2021-08-12 · Updated 2021-08-23 · CVE-2021-27794

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.0.1a Brocade Fabric OS versions prior to 8.2.3a Brocade Fabric OS versions prior to 7.4.2h

Description A vulnerability in the authentication mechanism of Brocade Fabric OS could allow a user to login with an empty password or an invalid password through telnet, ssh, and REST. This issue is related to weaknesses in the authentication procedure, which can be exploited by an attacker to gain access to the system.

Recommendations For versions prior to 9.0.1a, update to version 9.0.1a or later to resolve the issue. For versions prior to 8.2.3a, update to version 8.2.3a or later to resolve the issue. For versions prior to 7.4.2h, update to version 7.4.2h or later to resolve the issue. As a temporary workaround, consider restricting access to telnet, ssh, and REST until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-05144

CVE-2021-27794

Affected Products

Brocade Fabric Os

References · 9

• https://osv.dev/vulnerability/CVE-2021-27794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27794 · Security Note
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1552 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05144 · Security Note
• https://security.netapp.com/advisory/ntap-20210819-0001 · Note
• https://t.me/cibsecurity/27221 · Telegram Post
• https://t.me/cvenotify/19707 · Telegram Post
• https://t.me/cvenotify/19895 · Telegram Post
• https://t.me/cvenotify/19222 · Telegram Post