CVE-2025-6391: broadcom brocade_active_support_connectivity_gateway
CVSS: 9.1v3.1CriticalAnalyzed
Published 17-07-2025Last modified 18-07-2025
Vulnerability summary
CVE-2025-6391 is a critical (CVSS 9.1) vulnerability in broadcom brocade_active_support_connectivity_gateway. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.6% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
0.27%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 17-07-2025PublishedVulnerability first disclosed.
- 18-07-2025Last modifiedVulnerability information updated.
Description
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST7.1HighCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesSingle source
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
+0.03 pp
From 0.24% on 18-09-2026
18-09-202618-10-2026
EPSS score0.27%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Broadcom2 products
- brocade_active_support_connectivity_gateway≤ 3.2.0
- brocade ascg< 3.3.0
1 vendor · 2 products
References
1 links- support.broadcom.com/web/…Vendor Advisory