CVE-2023-46747
F5 BIG-IP Configuration Utility: Authentication Bypass
As of , CVE-2023-46747 in F5 BIG-IP Configuration Utility is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 31 October 2023
- US federal deadline
- 21 November 202321 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Known
- EPSS score
- 0.97Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.05 on 31 October 2023EPSS on the day CISA listed it.
- Public exploit
- 1 Metasploit module
- Fix
- Vendor advice: my.f5.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
CISA's description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
The CVE record's description, from f5
- CVE published
- 26 October 2023
- Assigned by
- f5
- CVSS
- 9.8 Critical (CVSS 3.1, from the CNA)
- CWE-288
- Authentication Bypass Using an Alternate Path or Channel
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: F5 BIG-IP TMUI AJP Smuggling RCEexploit module, rank excellent
BIG-IP Configuration Utility: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2023-46748SQL Injection | F5 BIG-IP Configuration Utility | Patch soon | 0.04 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org