The vulnerability in Brocade ASCG 3.4.0 arises because application‑defined user accounts are not properly protected by passwords, creating an authentication bypass that can be exploited by an unauthorized user. An attacker can create or use such weak accounts to access the web or management interfaces and perform privileged operations, including configuring the Brocade Support Link (BSL) and streaming, as well as disabling the ASCG application or preventing BSL data collection. The impact is a loss of confidentiality, integrity, and availability of the networking fabric’s support and monitoring functions.

Brocade ASCG version 3.4.0

The CVSS base score of 8.3 indicates high severity, and the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, but the potential damage is significant. Attackers likely obtain access through remote network connections to the ASCG management interface, exploiting the lack of password enforcement on custom user accounts. Once authenticated, they can modify BSL settings, alter streaming configuration, or disable critical components of the fabric’s monitoring infrastructure.