The vulnerability arises when Brocade Fabric OS processes firmware upgrade requests that include unvalidated parameters such as host or file path. These parameters are interpolated into system command strings and executed by the firmware management daemon without removing control or shell metacharacters. Consequently, an attacker can inject and execute arbitrary shell commands with the daemon’s elevated privileges, potentially compromising the entire switch. The weakness corresponds to CWE‑78, reflecting improper command handling that allows injection of executable code.

Affected vendors include Brocade. The flaw exists in Fabric OS 9.x versions prior to 9.2.2d and in Fabric OS 10.0.0 through 10.0.0a1. Firmware management daemons running on these releases are susceptible to exploitation when upgrade requests are processed.

The CVSS score of 7 indicates a high‑severity risk. The EPSS score is not reported, so the likelihood of exploitation is unclear but cannot be ruled out. The vulnerability is not listed in the CISA KEV catalog, implying no known exploitation reports as of the current data. Because the attack intrudes through the firmware upgrade interface, the likely vector is remote delivery of a crafted upgrade request over the management network, requiring the attacker to have network access to the device’s management interface.