CVE-2024-5461CWE-78

Command or parameter injection via unique embedded switch SNMP commands.

High · published February 15, 2025

CVSS v4.0
8.6
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Implementation of the Simple Network

Management Protocol (SNMP) operating on the Brocade 6547 (FC5022)

embedded switch blade, makes internal script calls to system.sh from

within the SNMP binary. An authenticated attacker could perform command

or parameter injection on SNMP operations that are only enabled on the

Brocade 6547 (FC5022) embedded switch. This injection could allow the

authenticated attacker to issue commands as Root.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-02-15T00:06Z
EPSS history
Timeline
  • 15 FEB 00:06Z
    Command or parameter injection via unique embedded switch SNMP commands.
    cvelistv5