CVE-2025-1976
Broadcom Brocade Fabric OS Code Injection Vulnerability
Description
CVE-2025-1976 is a medium-severity code injection vulnerability in Broadcom Brocade Fabric OS, the operating system that powers Brocade fibre channel switches used in enterprise storage area networks (SANs). Although Fabric OS versions starting with 9.1.0 removed root access, a local user with admin privileges can exploit this flaw to execute arbitrary code with full root privileges on versions 9.1.0 through 9.1.1d6. With a CVSS v3.1 score of 6.7 (MEDIUM), the vulnerability requires local access and high privileges, but successful exploitation completely bypasses the root access restrictions implemented in the 9.1.x branch. CISA has added CVE-2025-1976 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 1.05% at the 77.28th percentile suggests targeted exploitation by sophisticated threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| broadcom | fabric operating system | >= 9.1.0, < 9.1.1d7 |
References
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2025-1976 is classified under CWE-94 (Improper Control of Generation of Code), which occurs when software constructs code segments using externally-influenced input without sufficiently neutralizing special elements. In Brocade Fabric OS, an administrative user can leverage this weakness to inject and execute code that runs with root-level privileges, effectively bypassing the security restrictions designed to prevent root access in version 9.1.0 and later.
Learn more: CWE-94 — Improper Control of Generation of Code
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
This vulnerability also involves CWE-78 (OS Command Injection), where the admin-level interface allows injection of operating system commands that execute with elevated privileges. The combination of code injection and command injection enables a complete privilege escalation from admin to root.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2025-1976 has a CVSS v3.1 base score of 6.7 (MEDIUM) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The attack requires local access (AV:L) and high privileges (PR:H), limiting the attack surface to authenticated administrators who already have access to the Fabric OS CLI. However, the impact is severe once exploited: Confidentiality (High) means the attacker gains root-level access to all data on the switch, including SAN configurations, zoning information, and potentially data traversing the fibre channel fabric. Integrity (High) allows modification of switch firmware, insertion of persistent backdoors, and manipulation of SAN configurations that could redirect or intercept storage traffic. Availability (High) enables disruption of the entire SAN fabric, potentially causing widespread storage outages across the enterprise. Brocade switches are critical infrastructure components in data centers, and root-level compromise of a SAN switch can have cascading effects on all connected storage systems and servers.
Exploit Maturity
CVE-2025-1976 has been confirmed as actively exploited in the wild through its inclusion in CISA's Known Exploited Vulnerabilities catalog, with a remediation deadline of May 19, 2025. The EPSS score of 1.1% at the 77.3th percentile suggests exploitation is possible but not yet widespread. While the relatively low EPSS score suggests this is not a mass-exploitation vulnerability, the active exploitation confirmed by CISA indicates targeted attacks by sophisticated threat actors, likely advanced persistent threat (APT) groups with specific interest in enterprise SAN infrastructure. The Broadcom vendor advisory (25602) provides official details. The requirement for admin-level access suggests attackers are either compromising admin credentials through other means or leveraging insider access, both scenarios that are consistent with targeted enterprise attacks.
Remediation
-
Upgrade Brocade Fabric OS immediately. Update all affected switches running Fabric OS versions 9.1.0 through 9.1.1d6 to version 9.1.1d7 or later. Consult the Broadcom security advisory 25602 for specific upgrade procedures.
-
Audit administrative accounts. Review all admin accounts on Brocade switches, remove unnecessary administrative access, and enforce strong password policies. Implement role-based access control to limit the number of users with full admin privileges.
-
Enable and review audit logging. Ensure comprehensive audit logging is enabled on all Fabric OS switches. Review logs for unusual administrative commands, unexpected configuration changes, or signs of privilege escalation attempts.
-
Restrict management access. Limit Fabric OS management interface access (SSH, HTTP, serial console) to dedicated out-of-band management networks. Use access control lists (ACLs) to restrict management access to authorized IP addresses only.
-
Monitor SAN fabric integrity. Implement SAN fabric monitoring to detect unauthorized zoning changes, unexpected device registrations, or anomalous traffic patterns that could indicate compromise of switch infrastructure.
Technical Details
CVE-2025-1976 is a privilege escalation vulnerability in Broadcom Brocade Fabric OS affecting versions 9.1.0 through 9.1.1d6. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector requiring high privileges but with low complexity and no user interaction needed.
Starting with Fabric OS 9.1.0, Broadcom implemented security hardening that removed direct root access for administrators. However, CVE-2025-1976 reveals a flaw in this restriction: the admin-level command interface contains a code injection vulnerability that allows an authenticated administrator to bypass the root access removal and execute arbitrary code with full root privileges. The vulnerability combines elements of both CWE-94 (Code Injection) and CWE-78 (OS Command Injection), indicating that the admin shell or management interface fails to properly sanitize inputs that are subsequently evaluated or executed at the operating system level. This effectively nullifies the security improvement introduced in the 9.1.x branch, restoring the same level of access that the root removal was designed to prevent. The fix in version 9.1.1d7 properly validates and sanitizes the affected input paths to prevent code injection.
Frequently Asked Questions
Is CVE-2025-1976 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-1976 in the Known Exploited Vulnerabilities catalog. The targeted nature of the exploitation suggests sophisticated threat actors with interest in enterprise SAN infrastructure.
What products are affected by CVE-2025-1976?
Broadcom Brocade Fabric OS versions 9.1.0 through 9.1.1d6 are affected. This impacts Brocade fibre channel switches running these specific Fabric OS versions in enterprise storage area networks.
How do I fix CVE-2025-1976?
Upgrade Brocade Fabric OS to version 9.1.1d7 or later. Restrict management interface access to trusted networks and audit all administrative accounts for unnecessary privileges.
How severe is CVE-2025-1976?
CVE-2025-1976 has a CVSS v3.1 score of 6.7 (MEDIUM). While it requires local admin access to exploit, successful exploitation grants full root privileges on the switch, bypassing security restrictions. Given the critical role of SAN switches in enterprise infrastructure, the real-world impact can be severe.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.