Information disclosure in Brocade Fabric OS - CVE-2021-27796

Vulnerability identifier: #VU61561

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27796

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can read the contents of any file on the filesystem utilizing one of a few available binaries.

Brocade Fabric OS
Brocade - 6505 FC SAN Switch
Lenovo - B300 FC SAN Switch
Lenovo - B6505 FC SAN Switch
Lenovo - B6510 FC SAN Switch
Lenovo ThinkSystem DB400D FC Switch
Lenovo ThinkSystem DB610S FC Switch
Lenovo ThinkSystem DB620S FC Switch
Lenovo ThinkSystem DB630S FC Switch
Lenovo ThinkSystem DB720S FC Switch
Lenovo ThinkSystem DB800D FC Switch
Connectrix (Brocade)

Install updates from vendor's website.

Brocade Fabric OS - addressed in versions 7.4.1d, 7.4.2, 8.0.1 b, 8.0.2, 9.0.0
Connectrix (Brocade) - addressed in versions 7.4.2, 8.1.2h, 8.2.1c, 9.0.0

• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1721

• Information disclosure in Brocade Fabric OS
• Multiple vulnerabilities in Lenovo Networking Switches
• Multiple vulnerabilities in Dell Connectrix