High severity · published Feb 15, 2025
CVE-2024-5461
Command or parameter injection via unique embedded switch SNMP commands.
8.0
CVSS
0.4%
EPSS
No
On KEV
Description
Implementation of the Simple Network
Management Protocol (SNMP) operating on the Brocade 6547 (FC5022)
embedded switch blade, makes internal script calls to system.sh from
within the SNMP binary. An authenticated attacker could perform command
or parameter injection on SNMP operations that are only enabled on the
Brocade 6547 (FC5022) embedded switch. This injection could allow the
authenticated attacker to issue commands as Root.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Brocade Fabric OS · Brocade
before 8.2.3e1_pha · source: vendor
FO
Fabric Operating System · Broadcom
before 8.2.3e1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5461
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411
More from Brocade Fabric OS
7.5
CVE-2024-5462
Brocade Fabric OS may capture SNMP Passwords in clear text
5.5
CVE-2021-27798
privileged directory transversal.in Brocade Fabric OS versions 7.4.1.x and 7.3.x