Vulnerability · Published Apr 30, 2020 · Assigned by f5

CVE-2020-5884

Critical 9.1

In plain English

A critical-severity security flaw in BIG-IP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS NVD)9.1Critical

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring.

Affected products (as reported)

Vendor	Product	Versions
n/a	BIG-IP	15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1

References

https://support.f5.com/csp/article/K72540690 x_refsource_CONFIRM