CVE-2022-33186CWE-78command-injection

CVE-2022-33186

Critical · published December 9, 2022

CVSS v3.1
9.8
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

🚨 A remote attacker could commandeer your Brocade Fabric OS switch without needing any credentials — it’s like giving a stranger the keys to the city! 🔥 Imagine a hotel concierge who can change the room assignments, disable check-ins, and even erase guests from the system without any ID. This vulnerability lets attackers manipulate crucial settings on your network equipment as if they were checking into the hotel themselves! An attacker exploiting this vulnerability could wreak absolute havoc: they could disable the switch, change its IP address, and modify zoning settings, leading to a complete network shutdown. This level of access poses serious risks, leaving systems vulnerable to further attacks and operational chaos!

Put simply

Imagine a hotel concierge who can change the room assignments, disable check-ins, and even erase guests from the system without any ID. This vulnerability lets attackers manipulate crucial settings on your network equipment as if they were checking into the hotel themselves! This vulnerability in Brocade Fabric OS software allows remote unauthenticated attackers to execute commands on the switch, which can alter its critical configurations. Affected versions include v9.1.1, v9.0.1e, v8.2.3c, and v7.4.2j.

What to do

An attacker exploiting this vulnerability could wreak absolute havoc: they could disable the switch, change its IP address, and modify zoning settings, leading to a complete network shutdown. This level of access poses serious risks, leaving systems vulnerable to further attacks and operational chaos! Immediately patch your Brocade Fabric OS to the latest version to close this critical vulnerability. Ensure you audit your network configurations, and consider implementing additional security measures to detect unauthorized access attempts. 🛡️ You've got this! By following these steps, you'll reinforce your defenses and keep your network safe. 💪😊

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01662 · 76.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-12-09T03:15Z
Affected products (4)
ProductVersionsFixed in
broadcom/fabric_operating_systemall versions—
broadcom/fabric_operating_systemall versions—
broadcom/fabric_operating_systemall versions—
broadcom/fabric_operating_systemall versions—
References (2)
EPSS history
Timeline
  • 08 DEC 00:00Z
    A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute…
    cvelistv5