Cyber Resilience

CVE-2024-1509

Broadcom Brocade Active Support Connectivity Gateway ≤ 3.1.0

Published
28 February 2025
Modified
06 April 2026
Patch / advisory
CVSS Score v4 7.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0036 28th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2024-1509 is a high-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Broadcom Brocade Active Support Connectivity Gateway. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-1509 is a high-severity vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) affecting the Brocade ASCG Web Interface in versions prior to 3.2.0. The issue stems from the web interface not enforcing HTTP Strict Transport Security (HSTS) as defined by RFC 6797. HSTS is an optional response header that instructs browsers to communicate only via HTTPS, and its absence exposes the interface to risks such as protocol downgrades and weakened security controls.

Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction. A network-based adversary positioned for man-in-the-middle (MITM) attacks can perform SSL-stripping to downgrade HTTPS connections to HTTP, enabling traffic interception. This also facilitates downgrade attacks and reduces protections against cookie hijacking, potentially leading to high confidentiality and integrity impacts such as unauthorized access to sensitive data or session takeover.

The Broadcom security advisory recommends upgrading to Brocade ASCG version 3.2.0 or later to mitigate the vulnerability by enabling proper HSTS enforcement. Additional details are available in the advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428. The issue is associated with CWE-523 (Insufficiently Protected Credentials).

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of…

more

HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-0869Same product: Broadcom Brocade Active Support Connectivity Gateway
CVE-2025-7398Same product: Broadcom Brocade Active Support Connectivity Gateway
CVE-2025-6391Same product: Broadcom Brocade Active Support Connectivity Gateway
CVE-2024-5462Same vendor: Broadcom
CVE-2024-4161Same vendor: Broadcom
CVE-2024-20395Shared CWE-523
CVE-2025-64308Shared CWE-523
CVE-2023-4331Same vendor: Broadcom
CVE-2024-4282Same vendor: Broadcom
CVE-2026-23635Shared CWE-523

Affected Assets

broadcom
brocade active support connectivity gateway
≤ 3.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

SC-8 requires confidentiality protection for transmitted data, directly stopping credentials from traveling in plaintext.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-02 full match
prevents

Encryption of data-in-transit directly prevents exposure of credentials during login.

PR.AA-04 mostly match
prevents

Protecting identity assertions in transit covers credential transport but is narrower than the full control scope.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requires use of cryptography, directly enabling encryption of credentials in transit.

prevents

Requires secure information transfer, which can include protecting credentials in transit.

degrades

Addresses management of authentication information, indirectly supporting protection during transmission.

prevents

Requires network security controls that can protect credential transmission.

prevents

Addresses security of network services, which may include protecting authentication traffic.

prevents

Specifies application security requirements that can include secure credential transmission.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

RHEL 8 (2 rules)
  • V-230487 RHEL 8 must not have the telnet-server package installed. prevents CWE-523
  • V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-523

References