Threat database

A command injection vulnerability exists in the WebTools administrative interface of Brocade Fabric OS. It affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can exploit this to execute arbitrary shell commands with root privileges on the switch.

An OS command injection vulnerability exists in the PAM session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with a username or profile identifier containing shell metacharacters can execute arbitrary commands with root privileges when their SSH session ends.

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.

CVE-2025-58380 is a medium severity path traversal vulnerability in Brocade Fabric OS versions before 9.2.1. It allows an authenticated attacker with administrative privileges to exploit the shell command 'grep' to manipulate path variables and traverse directories outside intended boundaries. This vulnerability requires high privileges and no user interaction, limiting its exploitation scope. Although no known exploits are reported in the wild, successful exploitation could lead to unauthorized access or modification of sensitive files within the system. European organizations using Brocade Fabric OS in their storage area networks (SANs) could face risks to data confidentiality and integrity. Mitigation involves upgrading to Fabric OS 9.2.1 or later and restricting administrative shell access.