CVE-2024-1509 Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100
Brocade ASCG web interface lacks HSTS enforcement, allowing SSL-stripping and downgrade attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1509?
CVE-2024-1509 is a high-severity vulnerability in Brocade ASCG, published on 28 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Weakness: CWE-523
Which versions are affected by CVE-2024-1509?
It affects 1 product.
Products include Broadcom Brocade Active Support Connectivity Gateway.
How do I fix CVE-2024-1509?
No fix has been published for CVE-2024-1509 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1509 being exploited?
There is no known exploitation of CVE-2024-1509 in the wild and no public exploit code.
Other vulnerabilities in Brocade ASCG
- CVE-2026-85421 Missing authorization in Brocade Active Support Connectivity Gateway
- CVE-2026-85489 Missing authorization in Brocade Active Support Connectivity Gateway
- CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.
- CVE-2026-85486 Code injection in Brocade Active Support Connectivity Gateway
- CVE-2026-85487 Path traversal in Brocade Active Support Connectivity Gateway
Sources
Also known as GHSA-j6jw-hg33-x575.