CVE-2025-58379: Broadcom Fabric OS Info Disclosure Flaw

CVE-2025-58379 Overview

CVE-2025-58379 affects Broadcom Brocade Fabric Operating System versions prior to 9.2.1. The vulnerability allows a local authenticated attacker with lower privileges to reveal command line passwords by invoking commands that expose higher-privilege sensitive information. The issue is classified under [CWE-250: Execution with Unnecessary Privileges], indicating that certain command line operations execute with more privilege than required for the requesting user context.

Broadcom published Security Advisory #36850 to address this issue in Fabric OS 9.2.1 and later releases.

Critical Impact
A lower-privileged authenticated user on a Brocade Fabric OS switch can extract command line passwords, enabling lateral privilege escalation within the SAN fabric management plane.

Affected Products

Broadcom Brocade Fabric Operating System versions prior to 9.2.1
Brocade SAN switches running affected Fabric OS releases
Fibre Channel directors managed via Fabric OS command line interface

Discovery Timeline

2026-02-03 - CVE-2025-58379 published to NVD
2026-02-06 - Last updated in NVD database

Technical Details for CVE-2025-58379

Vulnerability Analysis

The flaw resides in the Brocade Fabric OS command line interface (CLI), where specific administrative commands execute with elevated privilege regardless of the invoking user's role. A user authenticated to the switch with a lower privilege role can run these commands and receive output that includes credential material intended only for higher-privilege accounts.

This is an information disclosure flaw rooted in improper privilege separation. The CLI commands do not adequately filter sensitive fields such as stored passwords or credential hashes from their output when called by users below the intended authorization tier. The vulnerability is local and requires valid authentication, which limits the attacker pool to existing fabric administrators and operators.

Successful exploitation yields plaintext or recoverable credentials usable to authenticate as a higher-privileged operator on the same switch or across the fabric, depending on how credentials are shared across managed devices.

Root Cause

The root cause is execution with unnecessary privileges, [CWE-250]. CLI command handlers run portions of their logic in a context that bypasses the role-based access control (RBAC) checks expected for sensitive output fields. Rather than scrubbing or redacting credential data based on the caller's role, the affected commands return the raw payload, exposing passwords stored or referenced by the system configuration.

Attack Vector

The attack vector is local and requires authenticated access. An adversary first obtains valid credentials for a low-privilege Fabric OS user account, either through legitimate provisioning, credential reuse, or prior compromise. After logging in over SSH, serial console, or the management Ethernet interface, the attacker invokes the affected commands and parses the response for credential fields.

No verified public proof-of-concept exists for this CVE. The Broadcom advisory enumerates the specific commands and conditions but does not publish exploitation steps. The exploitation prediction (EPSS) score reflects a very low probability of active exploitation, consistent with the local privilege prerequisite and the operational environment of SAN management networks.

No verified exploit code is available for CVE-2025-58379.
Refer to Broadcom Security Advisory #36850 for the list of affected commands and remediation guidance.

Detection Methods for CVE-2025-58379

Indicators of Compromise

Unexpected CLI sessions from low-privilege user accounts executing administrative or diagnostic commands outside their normal scope of duty.
Audit log entries showing repeated invocations of commands that return configuration or credential data by non-administrator roles.
Successful authentication events on the Fabric OS switch using credentials belonging to higher-privileged accounts shortly after a lower-privileged session.

Detection Strategies

Forward Fabric OS syslog and command audit records to a centralized log platform and alert on command executions that do not match each user's documented role.
Baseline normal CLI command usage per account and flag deviations such as operator-tier accounts running configuration export or credential-related commands.
Correlate authentication telemetry across the SAN fabric to detect privilege escalation patterns where a low-privilege login is followed by a high-privilege login from the same source.

Monitoring Recommendations

Enable verbose CLI command auditing on every Brocade switch and retain logs for the duration required by your incident response policy.
Monitor management plane network segments for unusual SSH or console activity originating from non-administrator workstations.
Periodically review the Fabric OS user database and role assignments to confirm that no unauthorized accounts have been added or elevated.

How to Mitigate CVE-2025-58379

Immediate Actions Required

Upgrade all affected Brocade switches to Fabric Operating System 9.2.1 or later as published in Broadcom Security Advisory #36850.
Rotate every credential stored on or managed through affected Fabric OS devices, including administrator, operator, and service accounts.
Audit the Fabric OS user list and remove or disable any account that is not required for current operations.

Patch Information

Broadcom addressed the vulnerability in Brocade Fabric OS 9.2.1. Operators running any earlier release should plan an upgrade following Broadcom's recommended firmware update procedure. Patch details and the full list of affected commands are documented in the Broadcom Security Advisory #36850.

Workarounds

Restrict CLI access to the management interface by limiting SSH connectivity to a dedicated administrative subnet protected by access control lists.
Apply the principle of least privilege when assigning Fabric OS roles and avoid granting CLI access to users who do not require it.
Disable or remove unused low-privilege accounts that could be leveraged to invoke the affected commands while the upgrade is being scheduled.

bash

# Example: restrict management access and rotate credentials after upgrade
# 1. Verify the running Fabric OS version
version

# 2. Upgrade to 9.2.1 or later (follow Broadcom firmware procedure)
firmwaredownload

# 3. Rotate user passwords after upgrade
passwd <username>

# 4. Review configured users and roles
userconfig --show -a