Brocade Fabric OS Hardcoded Credentials Vulnerability (CVE-2021-27797)

Critical Vulnerability Information Vulnerability ID: BSA-2021-1722 Affected Products: - Brocade Fabric OS (v8.2.1c, v8.1.2h and earlier versions, all v8.0.x and v7.x versions) - 2 other unknown products Severity: Low CVE Number: CVE-2021-27797 CVSS Score: 7.5 Initial Release Date: February 16, 2022 Last Updated Date: February 16, 2022 Workaround Available: Yes Vulnerability Details Vulnerability Description: Brocade Fabric OS versions v8.2.1c, v8.1.2h and earlier, as well as all v8.0.x and v7.x versions, contain hardcoded credentials that could allow attackers to gain system access. Affected Component: Hardcoded credentials, specifically the default account with default password . Summary of Mitigation or Fix: - The latest versions of Brocade Fabric OS (v9.0.0 and later) are not affected. - Brocade Fabric OS administration guides enforce changing default account passwords. - It is recommended to upgrade to Brocade Fabric OS v9.0.0, v8.2.1c, v8.1.2h, or higher to receive security updates. Workaround: - Brocade Fabric OS administration guides enforce a prompt to change the "default account password". Solution: - Brocade enhanced the default password change prompt in Brocade Fabric OS to comply with NIST SP 800-63B privacy requirements, ensuring that administrators must choose a non-default password during network device connection. - Enforced password change is mandatory starting from v9.0.0, v8.2.1c, v8.1.2h, and later versions. Additional Information Discoverer: Cody Martin (Black Lantern Security) Notes: - Brocade Fabric OS v7.4.1b and v7.3.1d have reached End of Availability (EOA) and are no longer supported. - Official recommendation: customers should run supported Brocade software versions. Version History: 1.0 (initial release on February 14, 2022)

Goal Reached Thanks to every supporter — we hit 100%!

Brocade Fabric OS Hardcoded Credentials Vulnerability (CVE-2021-27797)