PT-2025-6718 · Brocade · Brocade Fabric Os

Published 2025-02-14 · Updated 2026-02-23 · CVE-2024-5462

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.0

Description The issue arises when configuration settings in Brocade Fabric OS are not set to encrypt SNMP passwords, resulting in the exposure of SNMP privsecret and authsecret fields in plaintext. This can occur in a configupload capture or a supportsave capture if password encryption is not enabled. An attacker can utilize these passwords to fetch values of supported OIDs via SNMPv3 queries. Additionally, there are a limited number of MIB objects that can be modified.

Recommendations For Brocade Fabric OS versions prior to 9.2.0, update to version 9.2.0 or later to resolve the issue. As a temporary workaround, consider enabling encryption of SNMP passwords to prevent plaintext exposure. Restrict access to configupload and supportsave captures to minimize the risk of exploitation. Avoid using plaintext passwords in SNMPv3 queries until the issue is resolved.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-5462

Affected Products

Brocade Fabric Os

References · 7

• https://osv.dev/vulnerability/CVE-2024-5462 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5462 · Security Note
• https://twitter.com/CVETracker/status/1890853775163752939 · Twitter Post
• https://twitter.com/CVEnew/status/1890566377255366713 · Twitter Post
• https://t.me/cveNotify/152866 · Telegram Post
• https://t.me/cvedetector/18152 · Telegram Post