CVE-2021-27791

Status: ModifiedMedium (5.4)—

The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication header from the client, resulting in reading memory addresses outside the intended range. An unauthenticated attacker could discover a request, which could bypass the authentication process.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base score: 5.4

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.60%
Percentile among all scored CVEs: 47
Score date: 10/7/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Broadcom — Fabric Operating System

CWEs

CWE-125

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2021-27791",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@brocade.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Brocade Fabric OS",
          "versions": [
            {
              "status": "affected",
              "version": "Brocade Fabric OS before Brocade Fabric OS v9.0.1a and v8.2.3a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-12T15:15:07.737",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20210819-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "sirt@brocade.com"
    },
    {
      "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1491",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@brocade.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210819-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1491",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication header from the client, resulting in reading memory addresses outside the intended range. An unauthenticated attacker could discover a request, which could bypass the authentication process."
    },
    {
      "lang": "es",
      "value": "Una función que es usada para analizar el encabezado de Autenticación en el servicio de aplicaciones web de Brocade Fabric OS versiones anteriores a Brocade Fabric OS v9.0.1a y v8.2.3a, presenta un fallo en procesar apropiadamente un encabezado de autenticación malformado procedente del cliente, resultando en una lectura de direcciones de memoria fuera del rango previsto. Un atacante no autenticado podría descubrir una petición, que podría omitir el proceso de autenticación"
    }
  ],
  "lastModified": "2026-06-17T03:45:27.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D137CFD9-916B-4B8D-9E57-2EECCE5FD32B",
              "versionEndExcluding": "8.2.3a",
              "versionStartIncluding": "8.2.1"
            },
            {
              "criteria": "cpe:2.3:o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D7BD6F1-04FE-45C8-9154-70DBDC01A31F",
              "versionEndExcluding": "9.0.1a",
              "versionStartIncluding": "9.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@brocade.com"
}