CVE-2023-43746 BIG-IP Appliance mode external monitor vulnerability

2023-10-1012:36:52

CWE-267

www.cve.org

big-ip

appliance mode

external monitor

vulnerability

bypass

security boundary

8.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "All Modules"
    ],
    "product": "BIG-IP",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "*",
        "status": "unaffected",
        "version": "17.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "16.1.4",
        "status": "affected",
        "version": "16.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "15.1.9",
        "status": "affected",
        "version": "15.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "*",
        "status": "affected",
        "version": "14.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "*",
        "status": "affected",
        "version": "13.1.0",
        "versionType": "semver"
      }
    ]
  }
]