An OS command injection flaw exists in the maintenance command‑line diagnostic utilities of Brocade Fabric OS. The vulnerability arises because user‑supplied options are passed directly to underlying shell commands without proper sanitization, enabling a privileged user with maintenance account access to inject malicious commands. Exploitation yields arbitrary command execution with root privileges, granting full control over the device.

The flaw affects Brocade Fabric OS releases prior to 9.2.2d and all 10.0.0 versions up to 10.0.0a1. Administrators running these builds via the maintenance shell are at risk.

The CVSS score of 7 highlights a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, constrained to users possessing a maintenance account; however, once authenticated, an attacker can achieve privilege escalation to root. The risk remains significant pending patch deployment.