CVE-2025-9711
Broadcom Fabric Operating System ≤ 9.2.1c3
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-9711 is a high-severity Least Privilege Violation (CWE-272) vulnerability in Broadcom Fabric Operating System. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-9711 is a privilege escalation vulnerability in Brocade Fabric OS versions prior to 9.2.1c3. It enables a local authenticated user to elevate their privileges to root by exploiting the export option in the seccertmgmt and seccryptocfg commands. The issue is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-272 (Least Privilege Violation).
The vulnerability can be exploited by any local user with authenticated access to the system, requiring low complexity and no user interaction. Successful exploitation grants full root privileges, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability, such as arbitrary code execution, data modification, or system disruption.
Broadcom has published a security advisory detailing the issue, available at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36852, which recommends upgrading to Fabric OS 9.2.1c3 or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206741
Vulnerability Data
A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AC-6 directly requires employing least privilege so that elevated rights are granted only when needed and revoked immediately afterward.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy and ongoing review that prevents failure to drop elevated rights after privileged operations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricts and monitors privileged utility programs, directly addressing the need to drop elevated rights immediately after use.
Privileged access rights explicitly require least-privilege assignment and timely revocation after elevated operations.
Secure coding practices can prevent least-privilege violations but do not constitute the control itself.
Information access restriction supports least privilege but does not specifically mandate dropping rights after privileged operations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 24.04 (1 rule)
- V-270689 Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. prevents CWE-272
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-272
Windows Server 2022 (1 rule)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-272