by Kastro
Paper/Archive/CVE-2023-46747

CVE-2023-46747

F5 BIG-IP — BIG-IP Configuration utility unauthenticated remote code execution vulnerability

KEV · due 21 Novransomware useEPSS 97%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected

ProductAffectedFixed inSource
BIG-IP17.1.0–CNA
BIG-IP16.1.0–CNA
BIG-IP15.1.0–CNA
BIG-IP14.1.0–CNA
BIG-IP13.1.0–CNA

Scores by source

f5 (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorymy.f5.com/manage/s/article/K000137353refpacketstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.htmlrefsecpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chainrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747kevcisa.gov/known-exploited-vulnerabilities-catalog