F5 · BIG-IP Configuration Utility
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Cos'è
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CISA: F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
Cosa fare
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 21 novembre 2023
Altre falle sfruttate di F5
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 31 ott 2023 | SQL Injection | BIG-IP Configuration Utility | Alta 8,8 | 4,2% |
| 22 set 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critica 9,3 | 25% |
| 27 mar 2026 | Stack-Based Buffer Overflow | BIG-IP | Critica 9,3 | 2,3% |
| 10 mag 2022 | Missing Authentication | BIG-IP | Critica 9,8 | >99,9% |
| 18 gen 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Critica 9,8 | 62% |
| 3 nov 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critica 9,8 | >99,9% |
| 3 nov 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Critica 9,8 | 99,9% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.