Information Disclosure in Brocade ASCG

Executive Summary

This vulnerability allows an unauthenticated attacker on the network to query internal management endpoints on vulnerable Brocade ASCG versions before 3.5.0. By doing so, the attacker can gather sensitive configuration details and operational state of Brocade Fabric OS (FOS) switches managed by the ASCG. This leads to unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan your network for Brocade ASCG instances running versions before 3.5.0. Check for exposed management endpoints by querying internal management interfaces. Use network scanning tools like nmap to identify Brocade devices and verify their firmware versions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this vulnerability to map out your SAN fabric infrastructure, identify switch connections, and understand your storage network topology. This information could be used to plan further attacks, such as targeting specific switches or disrupting storage operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive network configuration details and switch connectivity attributes. Unauthorized disclosure of SAN fabric management topology may violate data protection requirements under GDPR for safeguarding personal data and under HIPAA for protecting health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Brocade ASCG to version 3.5.0 or later. Ensure management endpoints are not exposed to untrusted networks. Apply network segmentation to restrict access to these endpoints. Review and audit all Brocade Fabric OS switch configurations for unauthorized changes.

Useful 0 Not Useful 0