Broadcom Fabric OS: Stack-based buffer overflow in SNMPv3 request handling
Summary
Broadcom (Brocade) Fabric OS versions before 10.0.1 contain a stack-based buffer overflow in the SNMP daemon. When processing an SNMPv3 packet, a statistics handler copies attacker-controlled context name data into a fixed-size buffer without a length check. A remote attacker who can reach the SNMP service may crash the daemon (denial of service) or corrupt memory, and arbitrary code execution cannot be ruled out. The description states that no authentication is needed under default configuration, but the CVSS attack vector (adjacent network) conflicts with this and must be verified.
Affected
- Brocade Fabric OS versions 0 to below 10.0.1 (CNA record)
- Default configuration is affected according to the CNA record
Fixed in
- Fabric OS 10.0.1 or later (per Broadcom disclosure index; confirm the fixed build for your hardware in advisory 39078)
- Fixed build for the 9.2.x branch: Unknown.
Workaround
- Unknown from Broadcom sources. The Broadcom index tags a workaround, but its text could not be read.
- Third-party advice (not from Broadcom): limit SNMP access to trusted management stations.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS about 0.58%, measured shortly after publication.
Our recommendation
- Check whether Fabric OS switches are in use and whether SNMP is enabled.
- Schedule the upgrade to Fabric OS 10.0.1 or later and confirm the fixed build for your hardware in Broadcom's advisory.
- Until patched, disable SNMP if it is not needed, or restrict it to a separate management network with allow-listed sources.
- Monitor for unexpected SNMP daemon restarts.
- Verify the CVSS attack vector with the CNA and Broadcom records before relying on the exposure assessment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom Security Advisory 39078 support.broadcom.com
- Broadcom disclosure index (Brocade products) support.broadcom.com
- Rapid7 via Vulners vulners.com
- CVE List record via Vulners vulners.com
- VulDB vuldb.com
- CVE mirror with CVSS vector cve.threatint.com
- Strix CVE overview www.strix.ai
- CISA KEV alert April 2025 (different Brocade Fabric OS flaw) www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:22.
Original description (NVD)
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.