Vulnerability Description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Advanced Firewall Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Advanced Web Application Firewall | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Carrier-Grade Nat | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Ddos Hybrid Defender | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Ssl Orchestrator | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Domain Name System | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Local Traffic Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Policy Enforcement Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Automation Toolchain | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Container Ingress Services | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Security Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Analytics | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Acceleration Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Visibility And Reporting | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Fraud Protection Services | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Global Traffic Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Link Controller | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Webaccelerator | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Websafe | >= 13.1.0, <= 13.1.5 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-ExploitThird Party AdvisoryVDB Entry
- https://my.f5.com/manage/s/article/K000137353Vendor Advisory
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-activExploitThird Party Advisory
- http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-ExploitThird Party AdvisoryVDB Entry
- https://my.f5.com/manage/s/article/K000137353Vendor Advisory
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-activExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource
FAQ
What is CVE-2023-46747?
CVE-2023-46747 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbi...
How severe is CVE-2023-46747?
CVE-2023-46747 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-46747?
Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Carrier-Grade Nat, F5 Big-Ip Ddos Hybrid Defender.