PT-2025-9137 · Brocade · Brocade Ascg

Published 2025-02-28 · Updated 2026-01-29 · CVE-2024-1509

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brocade ASCG versions prior to 3.2.0

Description The issue concerns the lack of HTTP Strict Transport Security (HSTS) enforcement in the web interface, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The absence of HSTS allows for downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Recommendations For Brocade ASCG versions prior to 3.2.0, update to version 3.2.0 or later to enforce HSTS and mitigate the risk of downgrade attacks and SSL-stripping man-in-the-middle attacks. As a temporary workaround, consider configuring the server to instruct the browser to only communicate via HTTPS until a patch is available.

Fix

Weakness Enumeration

CWE-523

Related Identifiers

CVE-2024-1509

Affected Products

Brocade Ascg

References · 7

• https://osv.dev/vulnerability/CVE-2024-1509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1509 · Security Note
• https://t.me/cvedetector/19189 · Telegram Post
• https://twitter.com/cybercronai/status/1896217909644410998 · Twitter Post
• https://t.me/cveNotify/150236 · Telegram Post
• https://twitter.com/CVEnew/status/1895619294249242976 · Twitter Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428 · Note