CVE-2026-85487 in Active Support Connectivity Gateway
Summary
by MITRE • 10/08/2026
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Advanced Switch Configuration Gateway (ASCG) versions prior to 3.5.0 represents a critical security flaw within its HTTP service component, specifically classified under the Common Weakness Enumeration as CWE-22 Improper Limitation of a Pathname to a Restricted Directory. This path traversal issue allows an unauthenticated attacker operating on the local network segment to manipulate API requests directed at specific service endpoints. By exploiting insufficient input validation and sanitization mechanisms within the application logic, the attacker can bypass intended directory restrictions embedded in the file system access controls. The core technical flaw lies in the failure of the server-side processing routine to properly canonicalize or validate user-supplied path parameters before executing file operations. This deficiency enables the injection of relative path sequences, such as dot-dot-slash characters, which traverse upward through the directory hierarchy from the intended web root into sensitive system directories that are normally inaccessible to unprivileged users.
The operational impact of this vulnerability is severe due to its potential for arbitrary file read, write, and deletion operations without requiring any form of authentication or user credentials. The ability to perform arbitrary file reads allows an attacker to exfiltrate critical configuration files, source code containing hardcoded secrets, database connection strings, or private cryptographic keys stored on the server. This exposure can lead to a complete compromise of the network infrastructure managed by the ASCG appliance. Furthermore, the capability for arbitrary file write operations enables attackers to plant malicious scripts, backdoors, or modified system binaries that persist across reboots and evade standard security monitoring tools. The potential for file deletion poses an additional risk of denial-of-service conditions by removing essential operating system files or application dependencies required for the continued operation of the switch management plane.
From a threat actor perspective, this vulnerability aligns with ATT&CK techniques related to Initial Access via Valid Accounts if authentication were present, but in this unauthenticated context, it falls under T1059 Command and Scripting Interpreter through file manipulation or potentially T1204 User Execution if the written files are later executed by a privileged process. The lack of an authentication requirement significantly lowers the barrier to entry for exploitation, allowing any host on the same local network segment to initiate attacks without prior reconnaissance or credential theft phases. This characteristic makes the vulnerability particularly dangerous in environments where internal trust boundaries are not strictly enforced between management networks and general user segments.
Mitigation strategies must prioritize immediate patching of all affected Brocade ASCG instances to version 3.5.0 or later, which addresses these input validation deficiencies by implementing strict allow-lists for permitted file paths and enforcing canonicalization checks before any file system interaction occurs. In scenarios where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to restrict access to the ASCG management interface exclusively from trusted administrative subnets using firewall rules or VLAN isolation. Additionally, deploying Web Application Firewalls with specific rule sets capable of detecting and blocking path traversal payloads can provide a temporary layer of defense against exploitation attempts while permanent remediation efforts are underway. Regular auditing of file system permissions and monitoring for unusual access patterns to sensitive directories should also be implemented to detect potential compromise indicators resulting from this vulnerability.