An argument injection flaw in the Fabric OS configuration management utility allows an authenticated user with low‑privilege administrative rights to supply unsanitized search strings that are passed directly to internal commands. Because the utility blindly passes these strings to underlying system tools, the attacker can cause the system to reveal the contents of arbitrary files. The disclosed files may include configuration data, password hashes, secrets or other sensitive material, jeopardizing confidentiality and potentially enabling further compromise.

Brocade Fabric OS versions prior to 9.2.2d and all releases from 10.0.0 through 10.0.0a1 are affected. The flaw resides in the command‑line configuration viewer that skips validation of the search‑pattern argument. Users with local low‑privilege admin roles who can access the CLI are therefore vulnerable.

With a CVSS base score of 8.4 the vulnerability is rated high severity. Because an authenticated low‑privilege admin can trigger the injection, the attack surface is confined to local users who can log into the device, and no remote exploitation is described. EPSS is not available and the issue is not listed in the CISA KEV catalog, which suggests there are no publicly known active exploits at the time of analysis. Nevertheless, the capability to read arbitrary files makes it a critical internal attack vector.