CVE-2024-5460 is a High severity (CVSS 8.1) flaw in Brocade Fabric OS versions before 9.0.0. The default SNMP configuration contains a hard-coded community string, which lets an authenticated remote attacker read data from the switch using SNMP version 1 queries. Upgrade to Fabric OS 9.0.0 or later and review your SNMP settings.
What's affected
- Product: Brocade Fabric OS (FOS), the operating system on Brocade Fibre Channel SAN switches, now supported by Broadcom.
- Affected versions: all versions before 9.0.0, per the record. The vulnerability is in the default configuration file for the SNMP daemon.
- Fixed version: the record's wording implies 9.0.0 and later. The Broadcom advisory it links sits behind a browser check that blocked my request, so I could not confirm the fixed releases or any branch specific guidance. Read the Broadcom security advisory 24409 before you plan the upgrade.
- Severity: High, CVSS 8.1. The record rates confidentiality and integrity as high impact, with no availability impact.
- Exploitation: the record's KEV flag is false. I found no report of exploitation.
How to check if you're exposed
Find the Fabric OS version on each switch from the command line:
firmwareshow
Any version below 9.0.0 is in the affected range. Then review the SNMP configuration, which is where the exposure lives:
snmpconfig --show snmpv1
Look at the community strings in use and the hosts allowed to query them. If a string matches a vendor default, or if SNMP version 1 is enabled where you do not need it, change it. Exact command syntax differs between FOS releases, so confirm against the documentation for your version.
Also look at the network side. SNMP runs on UDP port 161. Check which source addresses can reach it on your management network.
What to do now
- Inventory every Brocade switch and record the FOS version.
- Read the Broadcom advisory and plan an upgrade to a fixed FOS release. Storage fabric changes need a maintenance window, so schedule early.
- Replace any default or vendor documented community string with a unique value, or move to SNMP version 3 with authentication and encryption if your monitoring tools support it.
- Restrict SNMP access with an access list so only your monitoring servers can query the switches.
- Check that monitoring systems do not log community strings in plain text where many people can read them.
- Review which data the SNMP tree exposes, including device and fabric information.
Why it matters
The record maps this to CWE-798, use of hard-coded credentials. A community string is the shared secret for SNMP version 1 and 2c. When the same string ships in every unit, anyone who learns it, which is easy when it is in the default configuration, can read from every unmodified switch.
SAN switches hold topology and zoning details that help an attacker plan a move toward storage. Reading is not changing, but reconnaissance data is valuable. The fix is easy to describe and easy to forget, which is why default credentials keep coming back: change them on day one, and verify it with an audit.
Quick check
Does this let an attacker change my switch configuration?
The record describes reading data via SNMP version 1 queries. Its vector shows high confidentiality and integrity impact, so check the Broadcom advisory for the full scope.
Is upgrading enough?
Upgrade, but also audit SNMP. Community strings you set yourself, and any retained from an older configuration, stay in effect after an upgrade, so confirm they are not defaults.
Sources
- Broadcom security advisory 24409 for Brocade Fabric OS, linked from the record (blocked my request, so its contents are not used here)
- NVD record data for CVE-2024-5460, as supplied in the batch record
Last reviewed: 19 October 2026.
