K04280042 : BIG-IP ASM vulnerability CVE-2019-6650

Security Advisory Description

F5 BIG-IP ASM may expose sensitive information and allow the system configuration to be modified when using non-default settings. (CVE-2019-6650)

Impact

The vulnerability is only present on multi-bladed systems (VIPRION) with BIG-IP ASM provisioned, on the following interfaces:

• Management interface in versions before BIG-IP 14.1.0.
• Any self IP with Port Lockdown configured asAllow All.

Note:Port Lockdowndefaults toAllow None.

In both of the previous configurations, a malicious actor may be able to connect to the affected interface to extract and/or modify sensitive information on the system.