Detections
Analytics

Brocade Fabric OS < 9.2.1 Multiple Vulnerabilities

medium Nessus Plugin ID 299687

Language:

Synopsis

The remote Brocade FabricOS host is affected by multiple vulnerabilities.

Description

The version of Brocade FabricOS installed on the remote host is prior to 9.2.1. It is, therefore, affected by multiple vulnerabilities:

 - Brocade Fabric OS has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.
 (CVE-2025-58379)

 - A vulnerability in Brocade Fabric OS could allow an authenticated attacker with admin privileges using the shell command grep to modify the path variables and move upwards in the directory structure or to traverse to different directories. (CVE-2025-58380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Brocade FabricOS 9.2.1 or later.

See Also

http://www.nessus.org/u?b096a7e8

http://www.nessus.org/u?bc050e6b

Plugin Details

Severity: Medium

ID: 299687

File Name: brocade_fabricos_CVE-2025-58379.nasl

Version: 1.2

Type: local

Family: Misc.

Published: 2/20/2026

Updated: 2/23/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2025-58379

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6

Threat Score: 1.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Vulnerability Information

CPE: cpe:/o:broadcom:fabric_operating_system, cpe:/o:brocade:fabric_os

Required KB Items: installed_sw/Brocade FabricOS

Exploit Ease: No known exploits are available

Patch Publication Date: 1/27/2026

Vulnerability Publication Date: 1/27/2026

Reference Information

CVE: CVE-2025-58379, CVE-2025-58380