High severity · published Nov 12, 2024
CVE-2024-7516
Brocade Fabric OS before 9.2.2 does not enforce strict host key checking
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a switch admin.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fabric OS · Brocade
before 9.2.2 · source: vendor
FO
Fabric Operating System · Broadcom
before 9.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7516
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25177
More from Fabric OS
6.7
CVE-2025-1976
Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
9.8
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1
9.8
CVE-2026-87684
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1
9.8
CVE-2023-3454
Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to…
8.8
CVE-2026-94585
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform