Brocade Embedded Switches SNMP Command Injection Vulnerability Allowing Root Access

A command or parameter injection vulnerability has been identified in the Simple Network Management Protocol (SNMP) implementation on Brocade 6547 (FC5022) embedded switch blades, running Fabric OS prior to 8.2.3e1_pha. The vulnerability arises because the SNMP binary makes internal script calls to system.sh, allowing authenticated attackers to inject commands into SNMP operations unique to this switch model. Exploitation of this vulnerability could enable attackers to execute commands with root privileges.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to execute commands as the root user on the affected switch.

Remediation

Users can upgrade to Brocade Fabric OS 8.2.3e1_pha to address this vulnerability, as this patch release removes the vulnerable component from the code.