CVE-2025-9711
Published: 03 February 2026
Summary
CVE-2025-9711 is a high-severity Least Privilege Violation (CWE-272) vulnerability in Broadcom Fabric Operating System. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating the specific flaw by upgrading to Brocade Fabric OS 9.2.1c3 or later directly eliminates the privilege escalation vulnerability in seccertmgmt and seccryptocfg commands.
Enforcing least privilege restricts local authenticated users from accessing or executing the export options in seccertmgmt and seccryptocfg that enable root escalation, directly addressing CWE-272.
Access enforcement ensures system mechanisms properly validate and restrict privilege elevations attempted through flawed command options.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local authenticated privilege escalation to root via command abuse directly matches Exploitation for Privilege Escalation.
NVD Description
A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.
Deeper analysisAI
CVE-2025-9711 is a privilege escalation vulnerability in Brocade Fabric OS versions prior to 9.2.1c3. It enables a local authenticated user to elevate their privileges to root by exploiting the export option in the seccertmgmt and seccryptocfg commands. The issue is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-272 (Least Privilege Violation).
The vulnerability can be exploited by any local user with authenticated access to the system, requiring low complexity and no user interaction. Successful exploitation grants full root privileges, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability, such as arbitrary code execution, data modification, or system disruption.
Broadcom has published a security advisory detailing the issue, available at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36852, which recommends upgrading to Fabric OS 9.2.1c3 or later to mitigate the vulnerability.
Details
- CWE(s)