Brocade ASCG: Missing authentication in data collector API
Summary
The data collection service of Brocade Active Support Connectivity Gateway (ASCG) before version 3.5.0 has an API endpoint that performs no authentication or authorization checks. An attacker with network access to the service can make the appliance open SSH connections to arbitrary hosts and execute arbitrary system commands, turning it into an unauthenticated proxy or execution point. No authentication is required, so the attack depends only on network reachability of the service.
Affected
- Brocade ASCG versions before 3.5.0 (affected range 0 to below 3.5.0 per the CVE record)
- Affected component: Data Collector API in the standard deployment
Fixed in
- Upgrade to Brocade ASCG 3.5.0 or later
- Whether a 3.4.x maintenance release exists is unknown.
Workaround
- No vendor workaround known. Broadcom's interim measures are unknown.
- Restrict network access to the ASCG appliance and its web/API ports to administrative hosts only until patched. Earlier ASCG advisories name ports 8030 and 8100; confirm the ports for your build before writing firewall rules.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed as known exploited (KEV) in the sources checked; the KEV catalog was not checked directly.
- No public proof of concept found.
Our recommendation
- Inventory all ASCG instances: version, deployment type and network reachability.
- Upgrade all affected instances to 3.5.0 or later; the same release also addresses related ASCG issues disclosed together.
- Until patched, restrict access to the ASCG service to management hosts and confirm no instance is reachable from outside the management network.
- Monitor for unexpected outbound SSH connections and unknown commands from the appliance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory support.broadcom.com
- VulDB CVE-2026-85423 vuldb.com
- VulDB 415297 vuldb.com
- Strix CVE-2026-85423 www.strix.ai
- Offseq CVE record mirror radar.offseq.com
- IMFHT advisory mirror 834111 cve.imfht.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:07.
Original description (NVD)
A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.