Read the docs
TI-2020-12134 Aliases CVE-2020-15387GHSA-wv2h-444w-8xv6

The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c…

Priority LOW 33CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-326.

Summary

The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.

Why it matters now

EPSS 0.00491 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Brocade SANnav & Brocade Fabric OSBrocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0 and Brocade SANnav v2.1.1—No fix listedCNA
  • Brocade SANnav & Brocade Fabric OS Vendor— Affected Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0 and Brocade SANnav v2.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:brocade_sannav:*:*:*:*:*:*:*:*before 2.1.1VulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*before 7.4.2; 8.2.0 to before 8.2.1VulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2a:*:*:*:*:*:*:*7.4.2aVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2b:*:*:*:*:*:*:*7.4.2bVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2c:*:*:*:*:*:*:*7.4.2cVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2d:*:*:*:*:*:*:*7.4.2dVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2f:*:*:*:*:*:*:*7.4.2fVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:7.4.2g:*:*:*:*:*:*:*7.4.2gVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:8.2.1:*:*:*:*:*:*:*8.2.1VulnerableBroadcom
  • cpe:2.3:a:broadcom:brocade_sannav:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* Versions before 7.4.2; 8.2.0 to before 8.2.1 Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2a:*:*:*:*:*:*:* Versions 7.4.2a Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2b:*:*:*:*:*:*:* Versions 7.4.2b Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2c:*:*:*:*:*:*:* Versions 7.4.2c Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2d:*:*:*:*:*:*:* Versions 7.4.2d Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2f:*:*:*:*:*:*:* Versions 7.4.2f Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:7.4.2g:*:*:*:*:*:*:* Versions 7.4.2g Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Broadcom
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:broadcom:fabric_operating_system:8.2.1a:*:*:*:*:*:*:*8.2.1aVulnerableBroadcom
cpe:2.3:o:broadcom:fabric_operating_system:8.2.1b:*:*:*:*:*:*:*8.2.1bVulnerableBroadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:8.2.1a:*:*:*:*:*:*:* Versions 8.2.1a Vulnerable ·Broadcom
  • cpe:2.3:o:broadcom:fabric_operating_system:8.2.1b:*:*:*:*:*:*:* Versions 8.2.1b Vulnerable ·Broadcom

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15387
  2. 2026-10-03 Alias added: GHSA-wv2h-444w-8xv6

References

Advisory 1

  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
  • TI-2024-03351 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. CVSS 3.1CRITICAL 9.0
  • TI-2024-19729 hard-coded credentials in the documentation that appear as the appliance root password CVSS 3.1CRITICAL 9.8
  • TI-2024-02079 Docker implementation in Brocade SANnav is missing Audit Rules. CVSS 4.0HIGH 8.6
  • TI-2023-15041 Web authentication and authorization bypass CVSS 3.1CRITICAL 9.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences