Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Published

2023-10-26T21:15:08.097

Last Modified

2025-04-02T20:32:09.563

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-288
Type: Primary
CWE-306

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	f5	big-ip_access_policy_manager	≤ 13.1.5	Yes
Application	f5	big-ip_access_policy_manager	≤ 14.1.5	Yes
Application	f5	big-ip_access_policy_manager	≤ 15.1.10	Yes
Application	f5	big-ip_access_policy_manager	≤ 16.1.4	Yes
Application	f5	big-ip_access_policy_manager	≤ 17.1.1	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 13.1.5	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 14.1.5	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 15.1.10	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 16.1.4	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 17.1.1	Yes
Application	f5	big-ip_advanced_web_application_firewall	≤ 13.1.5	Yes
Application	f5	big-ip_advanced_web_application_firewall	≤ 14.1.5	Yes
Application	f5	big-ip_advanced_web_application_firewall	≤ 15.1.10	Yes
Application	f5	big-ip_advanced_web_application_firewall	≤ 16.1.4	Yes
Application	f5	big-ip_advanced_web_application_firewall	≤ 17.1.1	Yes
Application	f5	big-ip_carrier-grade_nat	≤ 13.1.5	Yes
Application	f5	big-ip_carrier-grade_nat	≤ 14.1.5	Yes
Application	f5	big-ip_carrier-grade_nat	≤ 15.1.10	Yes
Application	f5	big-ip_carrier-grade_nat	≤ 16.1.4	Yes
Application	f5	big-ip_carrier-grade_nat	≤ 17.1.1	Yes
Application	f5	big-ip_ddos_hybrid_defender	≤ 13.1.5	Yes
Application	f5	big-ip_ddos_hybrid_defender	≤ 14.1.5	Yes
Application	f5	big-ip_ddos_hybrid_defender	≤ 15.1.10	Yes
Application	f5	big-ip_ddos_hybrid_defender	≤ 16.1.4	Yes
Application	f5	big-ip_ddos_hybrid_defender	≤ 17.1.1	Yes
Application	f5	big-ip_ssl_orchestrator	≤ 13.1.5	Yes
Application	f5	big-ip_ssl_orchestrator	≤ 14.1.5	Yes
Application	f5	big-ip_ssl_orchestrator	≤ 15.1.10	Yes
Application	f5	big-ip_ssl_orchestrator	≤ 16.1.4	Yes
Application	f5	big-ip_ssl_orchestrator	≤ 17.1.1	Yes
Application	f5	big-ip_domain_name_system	≤ 13.1.5	Yes
Application	f5	big-ip_domain_name_system	≤ 14.1.5	Yes
Application	f5	big-ip_domain_name_system	≤ 15.1.10	Yes
Application	f5	big-ip_domain_name_system	≤ 16.1.4	Yes
Application	f5	big-ip_domain_name_system	≤ 17.1.1	Yes
Application	f5	big-ip_local_traffic_manager	≤ 13.1.5	Yes
Application	f5	big-ip_local_traffic_manager	≤ 14.1.5	Yes
Application	f5	big-ip_local_traffic_manager	≤ 15.1.10	Yes
Application	f5	big-ip_local_traffic_manager	≤ 16.1.4	Yes
Application	f5	big-ip_local_traffic_manager	≤ 17.1.1	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 13.1.5	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 14.1.5	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 15.1.10	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 16.1.4	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 17.1.1	Yes
Application	f5	big-ip_automation_toolchain	≤ 13.1.5	Yes
Application	f5	big-ip_automation_toolchain	≤ 14.1.5	Yes
Application	f5	big-ip_automation_toolchain	≤ 15.1.10	Yes
Application	f5	big-ip_automation_toolchain	≤ 16.1.4	Yes
Application	f5	big-ip_automation_toolchain	≤ 17.1.1	Yes
Application	f5	big-ip_container_ingress_services	≤ 13.1.5	Yes
Application	f5	big-ip_container_ingress_services	≤ 14.1.5	Yes
Application	f5	big-ip_container_ingress_services	≤ 15.1.10	Yes
Application	f5	big-ip_container_ingress_services	≤ 16.1.4	Yes
Application	f5	big-ip_container_ingress_services	≤ 17.1.1	Yes
Application	f5	big-ip_application_security_manager	≤ 13.1.5	Yes
Application	f5	big-ip_application_security_manager	≤ 14.1.5	Yes
Application	f5	big-ip_application_security_manager	≤ 15.1.10	Yes
Application	f5	big-ip_application_security_manager	≤ 16.1.4	Yes
Application	f5	big-ip_application_security_manager	≤ 17.1.1	Yes
Application	f5	big-ip_analytics	≤ 13.1.5	Yes
Application	f5	big-ip_analytics	≤ 14.1.5	Yes
Application	f5	big-ip_analytics	≤ 15.1.10	Yes
Application	f5	big-ip_analytics	≤ 16.1.4	Yes
Application	f5	big-ip_analytics	≤ 17.1.1	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 13.1.5	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 14.1.5	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 15.1.10	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 16.1.4	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 17.1.1	Yes
Application	f5	big-ip_application_visibility_and_reporting	≤ 13.1.5	Yes
Application	f5	big-ip_application_visibility_and_reporting	≤ 14.1.5	Yes
Application	f5	big-ip_application_visibility_and_reporting	≤ 15.1.10	Yes
Application	f5	big-ip_application_visibility_and_reporting	≤ 16.1.4	Yes
Application	f5	big-ip_application_visibility_and_reporting	≤ 17.1.1	Yes
Application	f5	big-ip_fraud_protection_services	≤ 13.1.5	Yes
Application	f5	big-ip_fraud_protection_services	≤ 14.1.5	Yes
Application	f5	big-ip_fraud_protection_services	≤ 15.1.10	Yes
Application	f5	big-ip_fraud_protection_services	≤ 16.1.4	Yes
Application	f5	big-ip_fraud_protection_services	≤ 17.1.1	Yes
Application	f5	big-ip_global_traffic_manager	≤ 13.1.5	Yes
Application	f5	big-ip_global_traffic_manager	≤ 14.1.5	Yes
Application	f5	big-ip_global_traffic_manager	≤ 15.1.10	Yes
Application	f5	big-ip_global_traffic_manager	≤ 16.1.4	Yes
Application	f5	big-ip_global_traffic_manager	≤ 17.1.1	Yes
Application	f5	big-ip_link_controller	≤ 13.1.5	Yes
Application	f5	big-ip_link_controller	≤ 14.1.5	Yes
Application	f5	big-ip_link_controller	≤ 15.1.10	Yes
Application	f5	big-ip_link_controller	≤ 16.1.4	Yes
Application	f5	big-ip_link_controller	≤ 17.1.1	Yes
Application	f5	big-ip_webaccelerator	≤ 13.1.5	Yes
Application	f5	big-ip_webaccelerator	≤ 14.1.5	Yes
Application	f5	big-ip_webaccelerator	≤ 15.1.10	Yes
Application	f5	big-ip_webaccelerator	≤ 16.1.4	Yes
Application	f5	big-ip_webaccelerator	≤ 17.1.1	Yes
Application	f5	big-ip_websafe	≤ 13.1.5	Yes
Application	f5	big-ip_websafe	≤ 14.1.5	Yes
Application	f5	big-ip_websafe	≤ 15.1.10	Yes
Application	f5	big-ip_websafe	≤ 16.1.4	Yes
Application	f5	big-ip_websafe	≤ 17.1.1	Yes

References

http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://my.f5.com/manage/s/article/K000137353 Vendor Advisory ([email protected])
https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ Exploit, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://my.f5.com/manage/s/article/K000137353 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)