The vulnerability arises from insufficient sanitization of shell metacharacters in the Brocade SANnav command‑line scripting component. Authenticated users with command‑execution permissions can break out of the intended execution sandbox and inject arbitrary shell commands. This flaw elevates them to full administrative control over the target fabric switches, bypassing built‑in command allow‑lists and potentially compromising the entire SAN environment.

All versions of Brocade SANnav prior to 3.0.1a are affected. The issue specifically targets the CLI scripting interface of the SANnav product provided by Brocade.

The CVSS score of 8.6 indicates a high‑severity vulnerability, while the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be local authenticated, as an attacker must have legitimate CLI access with command execution rights. Once compromised, an attacker can execute any shell command, resulting in complete administrative takeover of the fabric switches.