CVE-2024-10403
Broadcom Fabric Operating System ≤ 9.2.0c1
Raw vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-10403 is a medium-severity Exposure of Core Dump File to an Unauthorized Control Sphere (CWE-528) vulnerability in Broadcom Fabric Operating System. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Automated Collection (T1119); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33422
Vulnerability Data
Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later…
more
captured via supportsave.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 3 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the core-dump file so that only authorized actors can read it.
Limits which processes and users are granted rights to the directory or file containing the core dump.
AC-4 enforces information flow rules that can block unauthorized external access to files or directories.
Requires confidentiality protection of information at rest, directly covering the exposed core-dump contents.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing and reviewing access permissions directly prevents unauthorized access to core-dump files.
Protecting confidentiality of data-at-rest covers sensitive memory contents stored in core dumps.
Logical segmentation and access protections stop external parties from reaching files that should remain internal.
Secure configuration baselines can restrict core-dump locations and permissions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Classification helps identify core dumps as sensitive, but does not enforce storage or access restrictions.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce access or stop core dump files from being exposed to unauthorized actors (that belongs to dependent controls such as A.8.3).
Granting only the minimum rights needed can prevent unauthorized access to core dumps, but does not address how or where they are generated.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248551 A sticky bit must be set on all OL 8 public directories to prevent unauthorized and unintended information transferred via shared system resources. blocks CWE-528
- V-248579 OL 8 must restrict access to the kernel message buffer. blocks CWE-552
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. blocks CWE-552