PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8205 Brocade CVE debrief

CVE-2016-8205 is a critical directory traversal issue in Brocade Network Advisor’s DashboardFileReceiveServlet. The NVD record says affected versions include those released prior to and including 14.0.2, and that a remote attacker could upload a malicious file into a filesystem location where it can be executed. Because the CVSS vector is network-reachable, requires no privileges, and no user interaction, this issue should be treated as urgent on any exposed Brocade Network Advisor deployment.

Vendor
Brocade
Product
CVE-2016-8205
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-14
Original CVE updated
2026-05-13
Advisory published
2017-01-14
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Brocade Network Advisor deployments, especially systems exposed to untrusted networks or used to receive dashboard files. Also relevant to teams that monitor web-facing management interfaces and file upload paths.

Technical summary

NVD classifies the weakness as CWE-22 (path traversal). The vulnerability affects Brocade Network Advisor up to and including version 14.0.2. The published CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable flaw with no required authentication or interaction and high potential impact if abused.

Defensive priority

Critical. Prioritize immediate verification of exposure, version inventory, and remediation on any Brocade Network Advisor instance at or below 14.0.2.

Recommended defensive actions

  • Identify all Brocade Network Advisor installations and confirm exact versions.
  • Treat any instance at version 14.0.2 or earlier as vulnerable until verified otherwise.
  • Apply the vendor-recommended fixed release or mitigation guidance from Broadcom/Brocade or HPE advisories.
  • Restrict network access to administrative interfaces and file upload endpoints to trusted hosts only.
  • Review logs for unusual upload activity or unexpected files placed in application-accessible directories.
  • Validate filesystem permissions so management uploads cannot be written to executable locations.

Evidence notes

The vulnerability description, affected version range, CVSS vector, and CWE come from the official NVD record. The NVD references include Brocade/Broadcom and HPE advisories plus a ZDI advisory and SecurityFocus entry, which support vendor and third-party confirmation of the issue. This debrief uses the CVE published date of 2017-01-14 and notes the NVD record was later modified on 2026-05-13.

Official resources

Publicly disclosed in the official CVE/NVD record on 2017-01-14. The NVD entry was modified on 2026-05-13. Vendor and third-party references listed in the NVD record include Broadcom/Brocade, HPE, ZDI, and SecurityFocus.