NetSight
IP …
high7.8Public exploit code

CVE-2012-1493

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2,…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Affected products

VendorProductAffected versions
F5Big-Ip Application Security Manager
Versions 9.2.0, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.4.8
F5Big-Ip Global Traffic Manager
All versions
Versions 9.2.2, 9.4.8, 10.0.0, 10.2.3, 11.0.0
F5Big-Ip Local Traffic Manager
All versions
Versions 9.0.0, 9.4.8, 10.0.0, 10.2.3, 11.0.0
F5Tmos
All versions
Versions 2.0, 4.0, 4.2, 4.3, 4.4
F5Big-Ip 1000
All versions
F5Big-Ip 11000
All versions
F5Big-Ip 11050
All versions
F5Big-Ip 1500
All versions
F5Big-Ip 1600
All versions
F5Big-Ip 2400
All versions
F5Big-Ip 3400
All versions
F5Big-Ip 3410
All versions

Weakness classification

CWE-255

References