Description (CNA)
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| F5 / BIG-IP | affected 17.1.0 before *; affected 16.1.0 before *; affected 15.1.0 before *; affected 14.1.0 before *; affected 13.1.0 before * |
CWE
CWE-288
References
- https://my.f5.com/manage/s/article/K000137353
- http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/
ADP enrichment
No English description supplied.
No English description supplied.