Critical severity · published Feb 28, 2025
CVE-2024-1509
Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Brocade ASCG before 3.2.0 Web Interface is not
enforcing HSTS, as defined by RFC 6797. HSTS is an optional response
header that can be configured on the server to instruct the browser to
only communicate via HTTPS. The lack of HSTS allows downgrade attacks,
SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking
protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASCG · Brocade
before 3.2.0 · source: vendor
BA
Brocade Active Support Connectivity Gateway · Broadcom
through 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1509
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428
More from ASCG
8.8
CVE-2026-0869
Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0
7.1
CVE-2025-7397
CLI history displays inline passwords