Critical severity · published Jul 17, 2025
CVE-2025-6391
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Brocade ASCG before 3.3.0 logs JSON
Web Tokens (JWT) in log files. An attacker with access to the log files
can withdraw the unencrypted tokens with security implications, such as
unauthorized access, session hijacking, and information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Brocade Active Support Connectivity Gateway · Broadcom
through 3.2.0 · source: NVD
Affected product
BA
Brocade Active Support Connectivity Gateway
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6391
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35951
More from Brocade Active Support Connectivity Gateway
9.1
CVE-2025-7398
Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036
9.1
CVE-2024-1509
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797
8.8
CVE-2026-87424
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the…
8.8
CVE-2026-85490
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained…
8.8
CVE-2026-85489
An authentication flaw exists in the Brocade ASCG administrative management service component