by Kastro
Paper/Archive/CVE-2023-41373

CVE-2023-41373

F5 BIG-IP — BIG-IP Configuration Utility vulnerability

EPSS 2%CVSS 9.9
critical.is priorityof 100
46
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 83.2.832 × 2016.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

ProductAffectedFixed inSource
BIG-IP17.1.0 – < 17.1.0.317.1.0.3CNA
BIG-IP16.1.0 – < 16.1.4.116.1.4.1CNA
BIG-IP15.1.0 – < 15.1.10.215.1.10.2CNA
BIG-IP14.1.0 – < 14.1.5.614.1.5.6CNA
BIG-IP13.1.0–CNA

Scores by source

f5 (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymy.f5.com/manage/s/article/K000135689