The vulnerability exists in Brocade ASCG versions before 3.0 where the web interfaces omit security‑related HTTP headers. Without these headers, an unauthenticated attacker can inject scripts into pages, trick users into clicking malicious links or buttons, and gain access to sensitive content. The flaw is classified as CWE‑79 and can compromise confidentiality, integrity, and availability of users interacting with the ASCG web UI.

Brocade Active Support Connectivity Gateway devices deploying any ASCG build older than 3.0 are affected. The vulnerability specifically targets web interfaces of the ASCG software, regardless of the physical model of the gateway.

The CVSS score of 6.5 reflects a moderate severity risk. Because the missing headers are triggered by HTTP requests to public endpoints, the attack vector is likely network‑based and does not require authentication. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can use any reachable ASCG web interface to send crafted requests and serve malicious content to clients who render the pages, enabling the described attacks.