CVE-2024-5461 — Command or parameter injection via unique embedded switch SNMP commands.

CVE-2024-5461

Command or parameter injection via unique embedded switch SNMP commands. PUBLISHED

Description (CNA)

Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.

Affected (CNA)

Vendor / product	Versions
Brocade / Brocade Fabric OS	affected before 8.2.3e1_pha

CWE

CWE-78

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.