BIG-IP virtual server TCP sequence numbers vulnerability CVE-2020-5947

On specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. (CVE-2020-5947)

Impact

Attackers may be able to spoof TCP packets to be used by a future connection, resulting in a TCP sequence prediction attack.

This issue affects platforms that do not have hardware-based SYN cookie capabilities. The following BIG-IP platforms do not contain the high speed bus (HSBe2) chip and do not have hardware-based SYN cookie capability, and are therefore vulnerable:

• BIG-IP 2000 series (C112)
• BIG-IP 4000 series (C113)
• BIG-IP i2000 series (C117)
• BIG-IP i4000 series (C115)
• BIG-IP Virtual Edition (VE)