K91054692 : BIG-IP Appliance mode iAppsLX vulnerability CVE-2024-23976

Security Advisory Description

When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. (CVE-2024-23976)

Impact

An authenticated attacker with local system access and the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure.

Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances. For more information about BIG-IP Appliance mode, refer to K12815: Overview of Appliance mode.