CVE-2025-7398 is a critical (CVSS 9.1) weak cryptography flaw in Broadcom's Brocade Active Support Connectivity Gateway (ASCG). Versions before 3.3.0 allow medium strength algorithms on internal ports 9000 and 8036. Upgrade to 3.3.0 or later, and limit which systems can reach those two ports until the upgrade is done, since the advisory text was not readable.
What's affected
The record says Brocade ASCG before 3.3.0 allows the use of medium strength cryptography algorithms on internal ports 9000 and 8036. Version 3.3.0 is the first release outside the affected range. The record cites Broadcom's security advisory 35950 and was published on 17 July 2025.
I could not read the Broadcom advisory, because the support site blocked my request with a browser check. This post therefore rests on the record. It does not tell me which algorithms are involved, how the fix changed them, or whether any workaround exists. Open the advisory with a Broadcom support login for the full text.
The CVSS vector in the record is network reachable, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact and no availability impact. The weakness is CWE-326, inadequate encryption strength. The record's KEV flag is false and I found no source saying it is exploited.
The ports are described as internal. That wording matters, but the vector still treats the flaw as network reachable, so how those ports are exposed in your environment decides your real risk.
How to check if you're exposed
Find your ASCG appliances and read their version in the product's own interface or its documentation. Anything before 3.3.0 is in scope.
Then find out who can reach ports 9000 and 8036 on each appliance. From a host that should not have access, a simple connection test shows whether the port is open:
nc -zv ascg.example.internal 9000
nc -zv ascg.example.internal 8036
Replace the host name with your appliance. An open result from a general user network is a sign that the internal ports are not well fenced. Review your firewall rules and network segment placement, and confirm only the systems that must talk to the gateway can do so.
If you want to see which cipher suites a port offers, a TLS scanner such as nmap's ssl-enum-ciphers script can list them, but only run it against systems you are allowed to test.
What to do now
- List every Brocade ASCG instance and its version.
- Schedule an upgrade to 3.3.0 or later, using Broadcom's normal upgrade path.
- Read advisory 35950 for the full fix notes and any interim steps.
- Restrict network access to ports 9000 and 8036 to the systems that need them.
- After upgrading, confirm the ports now negotiate only the strength the advisory describes.
- Record the change for your asset register.
Why it matters
Weak cryptography rarely makes a headline, but it quietly lowers the cost of reading or altering traffic that people believe is protected. A medium strength algorithm is one that is not yet broken in practice but falls short of current guidance. The risk grows with time, as attacks improve and hardware gets cheaper.
Support gateways are a tempting target because they carry data between a customer site and a vendor. Traffic between components of an appliance, even on internal ports, should meet the same standard as traffic that leaves the building. The remedy here is a vendor upgrade, and the check you can do today is to make sure those ports are not reachable from places they should not be.
Quick check
Which version fixes CVE-2025-7398?
Brocade ASCG 3.3.0. The record lists versions before 3.3.0 as affected.
Why is the score so high for a crypto strength issue?
The vector in the record is network reachable with no privileges and high confidentiality and integrity impact. I could not read the vendor advisory to see how Broadcom explains the score, so check it directly.
Sources
- Broadcom security advisory 35950 (could not be read when I checked)
- CVE-2025-7398 on Safeguard Gold
- CWE-326 on Safeguard Gold
Last reviewed: 18 October 2026.
