CVE-2026-85488 is a high severity flaw in Brocade ASCG before 3.5.0. A well known default password is embedded in a script that ships to every customer, so a local user with read access to the install path can find it and escalate privileges on OVA deployments that kept default settings.
What's affected
- Product: Brocade Active Support Connectivity Gateway (ASCG), also written Brocade ASCG.
- Affected: versions before 3.5.0.
- Fixed: 3.5.0 or later is the target the record implies. The Broadcom advisory (38384) is the vendor source, but its page needs JavaScript and did not load when I fetched it, so confirm the fixed version there.
- Attack path: local, low privileges, no user interaction (CVSS vector AV:L/AC:L/PR:L/UI:N).
Severity in the record: High, CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness class: CWE-798 (Use of Hard-coded Credentials).
How to check if you're exposed
The record gives no command line steps, so use the vendor path.
- Find the ASCG version in the appliance's administration interface or in your deployment records, and compare it with 3.5.0.
- Read Broadcom security advisory 38384 for the exact affected builds and upgrade steps.
- Check whether the appliance was deployed from the OVA and whether its default credentials were ever changed.
- Confirm which networks can reach the appliance. The record rates the attack path by network position, so the segment the appliance sits on matters.
What to do now
- Upgrade Brocade ASCG to 3.5.0 or later, following Broadcom advisory 38384.
- Change any default or shared password on the appliance, even if you have already upgraded.
- Limit shell access on the appliance to people who need it.
- Keep the appliance on a restricted management network and out of reach of general user networks.
- Record the upgrade date and version so you can answer an audit question quickly.
Why it matters
A default password in a distributed script is known to everyone who has the product. Reading the script is enough, so the credential does not protect anything. The weakness is CWE-798, hard coded credentials.
Two conditions apply per the record. The attacker must have a local account with read access to the installation path, and the deployment must still use default configuration, which the record ties to Open Virtual Appliance installs. Both are within your control. Change defaults on day one, and treat any appliance still on default settings as a finding. The record does not claim exploitation in the wild.
Quick check
Does changing the password remove the exposure?
It removes the known credential from play on your system. You should still upgrade to 3.5.0, since that is the fixed version named in the record.
Sources
Last reviewed: 18 October 2026.
