Missing authentication enables privileged API access in Brocade Active Support Connectivity Gateway

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.

• Brocade Active Support Connectivity Gateway: the normalized record identifies versions beginning at 0 and satisfying lessThan: 3.5.0 as affected. The record's default status outside that range is unaffected.
• Brocade ASCG Standard deployment: Brocade's advisory describes the affected scope as deployments before 3.5.0 and identifies the component as the CDA API.
• The advisory page also lists Brocade ASC-Gateway OVA and Brocade Support Link in its product listing, but it does not provide separate version boundaries for those entries. Do not extend the affected scope to those entries beyond the advisory's explicit Products Affected statement.

This is a CWE-306: Missing Authentication for Critical Function flaw in the Brocade Active Support Connectivity Gateway administrative management service. Brocade identifies the affected component as the CDA API. An unauthenticated user on an adjacent network can send direct API requests to perform functions that should require administrative authorization, including reading sensitive system configuration mapping data, changing managed device inventories, and altering operational settings. The record describes exploitation as requiring no credentials, no user interaction, and low complexity, but the specific endpoints, HTTP methods, request format, and authorization logic are not disclosed. The available evidence therefore does not establish operating-system code execution or direct access to every managed device.

The vulnerability is reachable over an adjacent or local network path to the Brocade ASCG administrative service. The attacker does not need authentication or user interaction, and the record characterizes direct API-request exploitation as low complexity. The adjacent-network requirement limits the attacker's position according to the available evidence, but it does not prevent unauthorized use of privileged management functions. The normalized record does not provide an exploitation-status or public-exploit result, and the Brocade advisory does not document a named campaign, public exploit, or indicator of compromise.

The flaw allows an adjacent-network user to invoke administrative functions without authentication. The documented outcomes include reading system configuration mapping data, modifying managed device inventory, and changing operational settings, creating confidentiality and integrity risks in the management plane. Those changes could cause configuration errors, unreliable management data, or disruption of administrative operations, although the actual consequence depends on deployment behavior. The available evidence does not confirm shell access, code execution, persistence, or direct control of managed devices.

The flaw can create the following operational and data consequences:

• Confidentiality: An unauthorized user can access sensitive system configuration mapping data.
• Integrity: Managed device inventories and operational settings can be modified without authentication.
• Operations: Unauthorized inventory or operational-setting changes could disrupt management, monitoring, or configuration accuracy; the actual effect depends on the functions enabled in the deployment.
• Scope limit: The evidence requires adjacent-network reachability and does not confirm operating-system code execution, persistence, or direct compromise of managed devices.

1. Update to Brocade ASCG 3.5.0: the record and Brocade advisory identify this release as providing the security update for the vulnerability.
2. Inventory each deployment and confirm its version after updating, especially deployments packaged as Brocade ASC-Gateway OVA or associated with Brocade Support Link. Do not treat a fix for one branch as proof that every parallel or separate branch has been addressed.
3. Until the update is applied, restrict access to the administrative service from adjacent networks to trusted management networks as a precaution. This reduces exposure but is not a vendor-confirmed workaround.
4. After updating, verify that administrative APIs require authentication and review available audit records. The advisory does not publish specific endpoints or a detailed validation procedure.

1. Inventory Brocade Active Support Connectivity Gateway deployments, including deployment type and running version.
2. Identify every version in the lessThan: 3.5.0 affected range and determine whether the administrative service and CDA API are reachable from an adjacent network.
3. If API audit or service logging is available, review requests without an authenticated context and unexpected changes to configuration mapping data, managed device inventories, or operational settings.
4. Treat log review as a precautionary check, not as a vendor-confirmed IOC. The absence of matching events does not prove that a deployment is unaffected or that unauthorized access did not occur.