PT-2024-2638 · Brocade · Brocade Fabric Os

Omar Eissa + 1 · Published 2024-04-04 · Updated 2024-06-28 · CVE-2023-3454

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions 9.0 through 9.2.0

Description A remote code execution vulnerability exists in Brocade Fabric OS, allowing an attacker to execute arbitrary code and gain root access to the Brocade switch. This issue arises due to the lack of measures to neutralize special elements used in the operating system command. The exploitation of this vulnerability could enable a remote attacker to execute arbitrary code and elevate their privileges to the root level.

Recommendations For Brocade Fabric OS versions 9.0 through 9.2.0, update to version 9.2.0 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-02705

CVE-2023-3454

Affected Products

Brocade Fabric Os

References · 14

• https://support.broadcom.com/external/content/SecurityAdvisories/0/23215 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02705 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3454 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3454 · Vendor Advisory
• https://t.me/cvenotify/75762 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240628-0004 · Note
• https://t.me/sysadm_in_channel/5092 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1776540915013996547 · Twitter Post
• https://twitter.com/fletch_ai/status/1777547190132740253 · Twitter Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23215 · Note
• https://t.me/pentestingnews/45603 · Telegram Post
• https://t.me/cvenotify/75767 · Telegram Post
• https://t.me/cvenotify/84791 · Telegram Post
• https://twitter.com/Komodosec/status/1776592970143388114 · Twitter Post