CVE-2024-5461

CVE-2024-5461 is a command or parameter injection vulnerability in the implementation of the Simple Network Management Protocol (SNMP) on the Brocade 6547 (FC5022) embedded switch blade. The SNMP binary makes internal script calls to system.sh, enabling injection flaws specifically in SNMP operations that are only enabled on this embedded switch. This issue, classified under CWE-78 (OS Command Injection), carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authenticated attacker with low privileges, positioned on an adjacent network, can exploit this vulnerability with low complexity and no user interaction required. By targeting SNMP operations on the Brocade 6547 (FC5022) embedded switch, the attacker can inject commands or parameters into the system.sh calls, ultimately executing arbitrary commands with root privileges. This grants high confidentiality, integrity, and availability impacts, potentially leading to full system compromise.

Mitigation details are available in the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24411. Security practitioners should consult this reference for patching instructions and workarounds specific to affected Brocade devices.