CVE-2024-7517

A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only possible on IP Extension platforms: Brocade 7810, Brocade 7840, Brocade 7850 and on Brocade X6 or X7 directors with an SX-6 Extension blade installed. The attacker must be logged into the switch via SSH or serial console to conduct the attack.

Score

CVSS 4.0 8.5 High

Status

Analyzed - sirt@brocade.com

Published

2024-11-21

Last modified

2025-09-09

Weaknesses

CWE-78

Affected products

• Fabric Operating System (Broadcom)
• Fabric Os (Brocade)

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25071