CVE-2026-87425 in Active Support Connectivity Gateway
Summary
by MITRE • 10/08/2026
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Brocade Advanced Switching Configuration Group versions prior to 3.5.0 represents a critical failure in cryptographic validation mechanisms within the management interface. This flaw allows an unauthenticated remote attacker to manipulate the TLS client trust store, which is responsible for validating the authenticity of certificates presented by servers during secure communications. By injecting an unauthorized Certificate Authority certificate into this store, the attacker effectively compromises the root of trust for all subsequent outbound connections initiated by the switch. This capability fundamentally undermines the integrity and confidentiality guarantees provided by Transport Layer Security protocols, as it allows the system to accept certificates signed by entities that have not been vetted or authorized by the network administrator.
From a technical perspective, this vulnerability stems from insufficient input validation and access control checks when handling certificate uploads through the management interface. The system fails to verify whether the user submitting the Certificate Authority has sufficient privileges to modify global trust settings. Consequently, any remote actor with network-level access to the unauthenticated portion of the management API can upload a malicious CA certificate. Once stored in the client trust store, this rogue authority is treated as legitimate by the TLS stack during handshake processes. This means that if an attacker controls or obtains a private key corresponding to this injected public CA, they can generate valid certificates for any domain or IP address targeted by the switch.
The operational impact of this vulnerability is severe, primarily facilitating Man-in-the-Middle attacks against outbound communications with managed switches and peer nodes. In a typical data center environment, Brocade ASCG devices frequently communicate with other network infrastructure components using encrypted channels to exchange configuration updates, status reports, and control plane information. If an attacker successfully exploits this flaw, they can intercept these connections without triggering certificate validation errors on the client side. This interception allows for the passive eavesdropping of sensitive operational data or active manipulation of commands sent between devices. Such capabilities could lead to unauthorized reconfiguration of network topology, disruption of services through traffic redirection, or theft of credentials transmitted over these compromised channels.
This vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-732 Incorrect Permission Assignment for Critical Resource within the Common Weakness Enumeration framework. The core issue lies in the system's failure to enforce strict permissions on resources that define trust relationships, allowing unprivileged users to alter security-critical configurations. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this exploit maps directly to T1557 Adversary-in-the-Middle and potentially T1078 Valid Accounts if the attacker leverages compromised credentials for initial access before exploiting the trust store modification. The ability to impersonate legitimate peers effectively neutralizes the security benefits of mutual TLS authentication often employed in enterprise fabric environments.
Mitigation strategies must prioritize immediate patching to version 3.5.0 or later, where these permission checks have been corrected to restrict certificate management operations to authenticated administrators with appropriate roles. In scenarios where upgrading is not immediately feasible, network segmentation should be implemented to isolate the management interface from untrusted networks. Additionally, disabling unnecessary services on the management plane and enforcing strict access control lists can reduce the attack surface available to remote attackers. Organizations should also audit their existing trust stores for any unauthorized Certificate Authorities as a precautionary measure against potential prior exploitation of this flaw.