K65720640 : BIG-IP SSL state mirroring vulnerability CVE-2020-5886

Security Advisory Description

BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring. (CVE-2020-5886)

Impact

On-path attackers may be able to read and modify the Diffie-Hellman (DH) parameters used by data plane SSL/TLS enabled virtual servers. Only HA pairs with session mirroring or connection mirroring enabled are vulnerable.