Brocade ASCG contains a script distributed to all customers that embeds a well‑known default password. Based on the description, it is inferred that the attacker requires local authenticated access to read the installation directory to discover the default password. Any local authenticated user who can read the installation directory can obtain this credential and then log in as an elevated user. This flaw enables a local privilege escalation on Open Virtual Appliance deployments that have not changed the factory configuration, potentially giving the attacker full control of the appliance.

The vulnerability affects Brocade Active Support Connectivity Gateway (ASCG) versions earlier than 3.5.0 deployed in Open Virtual Appliance (OVA) environments. Customers running older releases with default settings remain exposed.

The CVSS score of 7 indicates a high severity. Although no exploit probability score is published, the lack of a public exploit and absence from the KEV list suggest current exploitation risk is moderate. Based on the description, it is inferred that the attack vector involves local authenticated access with read permission to the installation path. The attack requires local authenticated access and read permission to the installation path, which is normally available to users with privileged installation rights. Once exploited, the attacker gains unrestricted privileges on the appliance.