TI-2024-05075 Aliases CVE-2024-5461 GHSA-m4cp-qj9v-7wpc

Command or parameter injection via unique embedded switch SNMP commands.

MEDIUM 40CWE-78Published 2025-02-15 · Updated 2025-09-09

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0045 39th percentileScored 2026-11-07

Fix Fixed Brocade Fabric OS (Brocade): 8.2.3e1_pha

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Brocade	Brocade Fabric OS	before 8.2.3e1_pha	8.2.3e1_pha	Patch available	CNA

Brocade Fabric OS VendorBrocade Affected before 8.2.3e1_pha Fixed in 8.2.3e1_pha Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:broadcom:fabric_operating_system::::::::	before 8.2.3e1	Vulnerable	Broadcom
cpe:2.3:h:broadcom:brocade_6547:-:::::::*	not specified by NVD	Running on	Broadcom

cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* Versions before 8.2.3e1 Vulnerable ·Broadcom
cpe:2.3:h:broadcom:brocade_6547:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Broadcom

Remediation

Fix · CNA Brocade Fabric OS (Brocade) Fixed in 8.2.3e1_pha

Timeline

2026-10-02 Threatist record created from CVE-2024-5461
2026-10-03 Alias added: GHSA-m4cp-qj9v-7wpc

References

Advisory 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411

TI-2025-01721 Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 KEVCVSS 4.0HIGH 8.6
TI-2016-06760 Path traversal in Brocade Network Advisor versions released prior to and including 14.0.2 CVSS 3.0CRITICAL 9.8
TI-2024-19729 hard-coded credentials in the documentation that appear as the appliance root password CVSS 3.1CRITICAL 9.8
TI-2016-06762 Path traversal in Brocade Network Advisor versions released prior to and including 14.0.2 CVSS 3.0HIGH 7.5
TI-2018-04739 OS command injection in Brocade Network Advisor CVSS 3.0CRITICAL 9.8
TI-2016-06761 Path traversal in Brocade Network Advisor versions released prior to and including 14.0.2 CVSS 3.0HIGH 7.5

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences