CVE-2024-1509 is a critical (CVSS 9.1) flaw in the Brocade Active Support Connectivity Gateway (ASCG) web interface before version 3.2.0. It does not send the HSTS header, which allows downgrade and SSL-stripping attacks. Upgrade to 3.2.0 or later and check how browsers reach the gateway.
What's affected
Per the NVD record, Brocade ASCG versions before 3.2.0 are affected. The web interface does not enforce HSTS as defined by RFC 6797.
HSTS is an optional response header that tells a browser to use only HTTPS for a site. Without it, a browser can be tricked into plain HTTP by a person in the network path. The record says this allows downgrade attacks, SSL-stripping man-in-the-middle attacks and weaker cookie hijacking protections.
The fixed release is 3.2.0 or later. I could not retrieve the Broadcom advisory page, so confirm the details there.
How to check if you're exposed
Find the ASCG version in the appliance web interface and compare it with 3.2.0.
You can also check whether the header is present with a plain HTTP request to the gateway from a management host:
curl -sI https://YOUR-ASCG-HOST/ | grep -i strict-transport-security
No output means the header is missing. Replace the host name with yours. If the version is 3.2.0 or later, the header should appear, but follow the vendor advisory for the authoritative test.
What to do now
- Read the Broadcom advisory for CVE-2024-1509 and confirm the fixed release for your deployment.
- Upgrade ASCG to 3.2.0 or later.
- Until then, make administrators reach the gateway only over HTTPS by bookmark and by policy, and restrict it to a management network.
- Where you control a reverse proxy in front of the gateway, set the Strict-Transport-Security header there.
- Check that the gateway certificate is valid and trusted by the admin workstations.
Why it matters
The record maps this to CWE-523, unprotected transport of credentials. Without HSTS, the first request from a browser may go over HTTP, and an attacker positioned on the network can intercept it, strip the upgrade to HTTPS and read or alter traffic, including session cookies and login credentials.
The attack needs a network position between the admin and the gateway, so you reduce the risk by keeping admin access on trusted segments. The 9.1 score is high because the confidentiality and integrity impacts are both rated high.
Try it yourself
Version drift on appliances is easy to miss. This demo shows continuous monitoring flagging a component that fell behind.
Click through it at your own pace, or open it full screen.
Quick check
What is HSTS?
HTTP Strict Transport Security. A response header that makes a browser use only HTTPS for a site, which blocks SSL-stripping downgrade attacks after the first visit.
Sources
- Broadcom security advisory 25428 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-1509
Last reviewed: 19 October 2026.
