What’s Vulnerable › Vulnerabilities

CVE-2018-6443

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-01-22 · updated 2026-06-17
• Weakness: CWE-255

Description

A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications. A remote unauthenticated user who has access to Network Advisor client libraries and able to decrypt the Jboss credentials could gain access to the Jboss web console.

Affected products

• Brocade Network Advisor versions released prior to and including 14.0.2: before 14.3.1 — fixed in 14.3.1
• NetApp Brocade Network Advisor: all versions

How to fix

Upgrade to a fixed version: Brocade Network Advisor versions released prior to and including 14.0.2 14.3.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/153035/Brocade-Network-Advisor-14.4.1-Unauthenticated-Remote-Code-Execution.html
• https://security.netapp.com/advisory/ntap-20190411-0005/
• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-743
• http://packetstormsecurity.com/files/153035/Brocade-Network-Advisor-14.4.1-Unauthenticated-Remote-Code-Execution.html
• https://security.netapp.com/advisory/ntap-20190411-0005/
• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-743

Get alerted when CVE-2018-6443 or the next vulnerability affects your stack