CVE-2024-5461: Command or parameter injection via unique embedded switch SNMP commands.

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-15 · updated 2026-06-17
Weakness: CWE-78

Description

Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.

Affected products

Brocade Fabric OS: before 8.2.3e1 — fixed in 8.2.3e1

How to fix

Upgrade to a fixed version: Brocade Fabric OS 8.2.3e1. Check the vendor advisory for mitigations.

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411

Get alerted when CVE-2024-5461 or the next vulnerability affects your stack