CVE-2024-5460: Broadcom Fabric OS SNMP Disclosure Flaw

CVE-2024-5460 is an information disclosure vulnerability in Broadcom Fabric Operating System affecting SNMP configurations. Attackers can exploit hard-coded community strings to access sensitive data. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-5460 Overview

CVE-2024-5460 is a hard-coded credentials vulnerability [CWE-798] in the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0. The default configuration file for the SNMP daemon ships with a static community string. An authenticated remote attacker can use this static community string in SNMP version 1 queries to read data from an affected device. Broadcom disclosed the flaw in Security Advisory #24409.

Critical Impact
Attackers with network access to the SNMP service can retrieve sensitive configuration and operational data from Brocade Fabric OS switches without knowledge of legitimate credentials.

Affected Products

Broadcom Fabric Operating System versions before v9.0.0
Brocade SAN switches running vulnerable Fabric OS builds
Deployments using the default SNMP daemon configuration

Discovery Timeline

2024-06-26 - CVE-2024-5460 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5460

Vulnerability Analysis

The flaw resides in the shipped configuration file for the SNMP daemon on Brocade Fabric OS. The file contains a hard-coded community string that is identical across affected deployments. SNMP version 1 uses community strings as the sole authentication mechanism and transmits them in cleartext. An attacker who knows the static value can issue GET and GETNEXT requests to enumerate the device's Management Information Base (MIB).

Retrievable data can include interface tables, routing information, running configuration fragments, and hardware inventory. This information supports reconnaissance for follow-on attacks against the storage fabric.

Root Cause

The vulnerability stems from the use of hard-coded credentials [CWE-798] in the default SNMP daemon configuration. Because the community string is embedded in the shipped configuration rather than generated per device, every unpatched deployment that retains defaults shares the same secret. Operators who never rotate the community string inherit the shared credential.

Attack Vector

Exploitation requires network reachability to UDP port 161 on the target switch. The attacker sends SNMPv1 queries containing the static community string. The device responds with MIB data for any object the community string is authorized to read. No user interaction is required, and the attack does not affect availability.

Because SNMPv1 lacks encryption, the same community string can also be captured from unrelated network traffic and reused. See the Broadcom Security Advisory #24409 for vendor technical detail.

Detection Methods for CVE-2024-5460

Indicators of Compromise

Inbound SNMPv1 traffic to UDP/161 on Fabric OS switches from unexpected source addresses
Successful SNMP GetResponse packets to hosts outside the approved network management subnet
Bulk MIB walks or repeated GETNEXT requests originating from non-management systems

Detection Strategies

Inspect running SNMP configuration on Brocade switches for the default community string and any SNMPv1 access entries
Correlate firewall and switch logs for SNMPv1 sessions to fabric management interfaces
Alert on SNMP queries that use community strings not defined by the local operations team

Monitoring Recommendations

Baseline authorized SNMP pollers and generate alerts for queries from any other source
Forward switch syslog and NetFlow to a centralized data lake for retrospective hunts on UDP/161 activity
Track configuration drift on Fabric OS devices to detect reintroduction of default SNMP settings

How to Mitigate CVE-2024-5460

Immediate Actions Required

Upgrade Brocade Fabric OS to v9.0.0 or later per Broadcom Security Advisory #24409
Remove the default SNMP community string and replace it with a unique, high-entropy value
Restrict UDP/161 access at the switch and upstream firewalls to the network management subnet only
Audit all Fabric OS switches for the presence of the shipped default configuration

Patch Information

Broadcom addressed the vulnerability in Fabric OS v9.0.0 and later. Full remediation guidance is available in the Broadcom Security Advisory #24409. Operators should confirm the running firmware version and schedule upgrades on all in-scope switches.

Workarounds

Disable SNMPv1 and require SNMPv3 with authentication and privacy where the platform supports it
Apply access control lists so only designated management hosts can reach UDP/161
Rotate community strings on every switch and remove any values matching the shipped defaults

bash

# Configuration example - restrict SNMP and remove defaults on Brocade Fabric OS
snmpconfig --set snmpv1 --disable
snmpconfig --set community --index 1 --community <unique-string> --access ro
ipfilter --create mgmt_snmp --proto udp --dport 161 --srcip <mgmt-subnet> --permit
ipfilter --activate mgmt_snmp