Brocade Active Support Connectivity Gateway versions before 3.5.0 accept configuration form submissions from users and then immediately evaluate the submitted data before performing any validation. Because the input is not sanitized first, a malicious actor who can authenticate and access the configuration interface can supply specially crafted text that is executed by the server. The outcome is that the attacker gains arbitrary code execution on the device, effectively taking control of the application and potentially the underlying operating system.

The affected product is Brocade Active Support Connectivity Gateway. The vulnerability exists in all releases prior to version 3.5.0 of the ASCG software.

The CVSS score of 8.6 categorizes this flaw as a high severity issue, and the failure to validate input is listed as CWE‑95 (Improper Neutralization of Special Elements used in an Expression Language). The exploit requires authentication, but an attacker with basic user privileges is sufficient to submit the dangerous form. EPSS data is not available, and the vulnerability is not yet included in the CISA KEV catalog. Given the absence of mitigation in earlier releases, the likelihood of exploitation remains significant for environments that have not applied the Brocade ASCG 3.5.0 update.