CVE-2025-58380: Brocade Fabric OS Path Traversal Flaw

CVE-2025-58380 Overview

CVE-2025-58380 is a path traversal vulnerability [CWE-35] in Broadcom Brocade Fabric OS versions prior to 9.2.1. The flaw allows an authenticated attacker with administrative privileges to abuse the shell grep command to manipulate path variables and traverse the directory structure outside of intended boundaries. Exploitation requires local access and high privileges, limiting the realistic attack surface to insiders or attackers who have already compromised an admin account. The vulnerability does not impact integrity or availability and exposes only low-sensitivity information. Broadcom has addressed the issue in Fabric OS 9.2.1.

Critical Impact
An authenticated admin can leverage the grep shell command to escape expected directory boundaries and read files outside the intended path scope on Brocade Fabric OS devices running versions before 9.2.1.

Affected Products

Broadcom Brocade Fabric Operating System (Fabric OS) versions prior to 9.2.1
Brocade SAN switches running vulnerable Fabric OS builds
Storage fabric environments managed through the affected Fabric OS shell

Discovery Timeline

2026-02-03 - CVE-2025-58380 published to NVD
2026-02-06 - Last updated in NVD database

Technical Details for CVE-2025-58380

Vulnerability Analysis

The vulnerability resides in how Brocade Fabric OS handles path variables passed to the shell grep command. The command does not sufficiently constrain user-supplied path arguments, enabling directory traversal sequences to resolve outside the intended working directory. An authenticated administrator can issue crafted grep invocations to navigate to arbitrary locations in the file system. The issue is classified under [CWE-35] (Path Traversal: '.../...//'), which captures variations of relative path manipulation that defeat naive sanitization. Because the attack vector is local and requires high privileges, the practical risk is bounded but still meaningful in environments with strict separation of duties.

Root Cause

The root cause is improper sanitization of path components consumed by the grep command exposed through the Fabric OS administrative shell. Path variables are not normalized to remove relative traversal sequences before being used to resolve file system targets. As a result, an attacker can supply traversal patterns that move upward in the directory tree or pivot into adjacent directories the shell was not intended to expose.

Attack Vector

Exploitation requires an authenticated session with administrative privileges on the Fabric OS shell. The attacker invokes grep with crafted path arguments containing traversal sequences. The shell resolves these paths and returns content from locations outside the expected scope. No network access, user interaction, or additional privilege escalation steps are required beyond the initial authenticated admin session.

No public proof-of-concept code has been released for this issue. For technical details, refer to the Broadcom Security Advisory #36854.

Detection Methods for CVE-2025-58380

Indicators of Compromise

Shell history entries containing grep invocations with ../ or similar traversal sequences in path arguments
Administrative shell sessions accessing files outside of standard Fabric OS configuration and log directories
Unexpected admin logins to Brocade switches followed by file enumeration activity

Detection Strategies

Audit Fabric OS command history and syslog forwarding for grep commands referencing absolute paths or relative traversal patterns
Correlate admin authentication events with subsequent shell command activity to identify anomalous file access
Flag any Fabric OS shell access from accounts that do not regularly perform administrative operations

Monitoring Recommendations

Forward Fabric OS audit logs and command history to a centralized SIEM for retention and correlation
Establish a baseline of normal administrative shell activity and alert on deviations
Review privileged account usage on storage fabric infrastructure at regular intervals

How to Mitigate CVE-2025-58380

Immediate Actions Required

Upgrade Brocade Fabric OS to version 9.2.1 or later on all affected switches
Inventory all Brocade SAN devices and verify running firmware versions against the fixed release
Restrict administrative shell access to a minimum set of named accounts and enforce multi-factor authentication on the management plane

Patch Information

Broadcom has released Fabric OS 9.2.1, which remediates the path traversal in the grep shell command. Customers should consult the Broadcom Security Advisory #36854 for the authoritative upgrade path and supported builds for their hardware.

Workarounds

Limit administrative account issuance and rotate credentials for any shared admin accounts on Fabric OS devices
Restrict management network access to Brocade switches using ACLs or jump hosts so only authorized operators can reach the shell
Enable command auditing and centralized log forwarding to deter and detect misuse by privileged users

bash

# Verify Fabric OS version on a Brocade switch
version

# Confirm running firmware is 9.2.1 or later
firmwareshow