K16861 : BIG-IQ remote authentication vulnerability CVE-2015-4637

Security Advisory Description

When remote authentication is configured on the BIG-IQ system for a LDAP server that allows anonymous BIND operations, a unauthenticated user may obtain an authentication token from the REST API for any known (or guessed) LDAP user account and will receive all the access and privileges of that user account for REST API calls. (CVE-2015-4637)
Impact
An attacker may be able to obtain an authentication token from the representational state transfer (REST) application programming interface (API) for known, or guessed, Lightweight Directory Access Protocol (LDAP) user accounts.