CVE-2025-58383

High

Published: 03 February 2026

Published

03 February 2026

Modified

06 February 2026

KEV Added

—

Patch

—

CVSS Score v4 8.4 CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0051 39.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-58383 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Broadcom Fabric Operating System. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-58383 is a privilege escalation vulnerability in Brocade Fabric OS versions before 9.2.1c2. It enables an administrator-level user to execute the bind command, bypassing security controls and allowing the execution of arbitrary commands. The issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-250 (Execution with Unnecessary Privileges).

An administrator-level user can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation grants escalated privileges, enabling arbitrary command execution with high impacts to confidentiality, integrity, and availability.

The Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36878 provides details on mitigation, including upgrading to Brocade Fabric OS version 9.2.1c2 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-206763

Vulnerability details

A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands.

CWE(s): CWE-250

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct privilege escalation via exploitation of unnecessary privileges (CWE-250) allowing bypass of controls for arbitrary command execution by an authenticated admin user.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0