Actively exploited · Published Oct 26, 2023 · Assigned by f5
CVE-2023-46748BIG-IP Configuration utility authenticated SQL injection vulnerability
High 8.8 Exploited
In plain English
A high-severity SQL injection in BIG-IP from F5. Attackers are actively exploiting it in the wild (listed by CISA on October 31, 2023). The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 21, 2023.
Official description
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H