CVE-2023-3454 is a high severity (CVSS 8.6) command injection in Brocade Fabric OS, after version 9.0 and before 9.2.0. NVD says it could let an attacker run code and gain root on the switch. Upgrade to 9.2.0 or later after checking the Broadcom advisory for your platform.
What's affected
The NVD record describes a remote code execution vulnerability in Brocade Fabric OS in versions after 9.0 and before 9.2.0. The product is listed as broadcom:fabric_operating_system. The record says an attacker could execute arbitrary code and use it to gain root access to the switch.
The range implies that 9.2.0 and later are outside the affected set, but the Broadcom advisory (ID 23215) is the authority for exact fixed builds and for which hardware platforms are covered. The advisory page could not be retrieved when we reviewed this entry, because the vendor site blocked automated access. Open it in a browser and confirm the details.
NetApp also published a notice for the same CVE, so check it too if you buy Brocade switches through NetApp.
How to check if you're exposed
On the switch, the firmware version is shown by the firmware version command in the Fabric OS command line.
firmwareshow
Compare the result with the fixed release named in the Broadcom advisory. Record the version for every switch in every fabric, since mixed firmware levels are common in storage networks that were upgraded in stages.
Also review who and what can reach the management interface. Management ports should sit on a dedicated network, with access limited to named administrators and jump hosts.
What to do now
- List every Brocade Fabric OS switch and its firmware version.
- Read the Broadcom advisory and select the fixed release that your hardware supports.
- Schedule the upgrade through your normal storage change process, since a fabric firmware update needs planning.
- Until the upgrade, restrict management plane access to a small trusted network.
- Review switch accounts and audit logs for logins or commands you do not recognise.
Why it matters
The weakness is CWE-78, improper neutralization of special elements in an OS command. Input that should be treated as data reaches a command interpreter on the device. On a network appliance that often means the injected command runs with very high privilege, which matches the root access described in the record.
Storage network switches rarely get the same patch discipline as servers, and they carry data that the whole business depends on. The record does not state exploitation in the wild and the CVE is not in the CISA KEV catalog. Treat the risk as a firmware hygiene problem: know the version, know the management exposure, and keep both on a schedule.
Quick check
Does 9.2.0 fix this?
The record range says versions before 9.2.0 are affected. Confirm the exact fixed build and platform support in the Broadcom advisory before you plan the upgrade.
Sources
Last reviewed: 19 October 2026.
