Actively exploited · Published Oct 26, 2023 · Assigned by f5
CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity authentication bypass in BIG-IP from F5. Attackers are actively exploiting it in the wild (listed by CISA on October 31, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 96.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 21, 2023.
Official description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected products (as reported)
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://my.f5.com/manage/s/article/K000137353 vendor-advisory
- http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747 government-resource