Critical severity · published Feb 28, 2025
CVE-2024-1509
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Brocade ASCG before 3.2.0 Web Interface is not
enforcing HSTS, as defined by RFC 6797. HSTS is an optional response
header that can be configured on the server to instruct the browser to
only communicate via HTTPS. The lack of HSTS allows downgrade attacks,
SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking
protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Brocade Active Support Connectivity Gateway · Broadcom
through 3.1.0 · source: NVD
Affected product
BA
Brocade Active Support Connectivity Gateway
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1509
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428
More from Brocade Active Support Connectivity Gateway
9.1
CVE-2025-7398
Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036
9.1
CVE-2025-6391
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files
8.8
CVE-2026-87424
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the…
8.8
CVE-2026-85490
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained…
8.8
CVE-2026-85489
An authentication flaw exists in the Brocade ASCG administrative management service component