NetSight
IP …
critical9.8Known exploited

CVE-2023-46747

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-10-31. Federal due date: 2023-11-21.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products

VendorProductAffected versions
F5Big-Ip Access Policy Manager
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Advanced Firewall Manager
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Advanced Web Application Firewall
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Carrier-Grade Nat
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Ddos Hybrid Defender
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Ssl Orchestrator
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Domain Name System
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Local Traffic Manager
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Policy Enforcement Manager
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Automation Toolchain
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Container Ingress Services
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1
F5Big-Ip Application Security Manager
from 13.1.0 through 13.1.5
from 14.1.0 through 14.1.5
from 15.1.0 through 15.1.10
from 16.1.0 through 16.1.4
from 17.1.0 through 17.1.1

Weakness classification

CWE-288CWE-306

References