Design/Logic Flaw

2019-07-0319:15:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

CPENameOperatorVersion
big-ip_access_policy_managerge13.0.0
big-ip_access_policy_managerlt13.1.1.5
big-ip_access_policy_managerge12.1.0
big-ip_access_policy_managerlt12.1.4.1
big-ip_access_policy_managerge14.0.0
big-ip_access_policy_managerlt14.0.0.5
big-ip_access_policy_managerge14.1.0
big-ip_access_policy_managerlt14.1.0.6
big-ip_advanced_firewall_managerge13.0.0
big-ip_advanced_firewall_managerlt13.1.1.5

Name	Operator	Version
big-ip_access_policy_manager	ge	13.0.0
big-ip_access_policy_manager	lt	13.1.1.5
big-ip_access_policy_manager	ge	12.1.0
big-ip_access_policy_manager	lt	12.1.4.1
big-ip_access_policy_manager	ge	14.0.0
big-ip_access_policy_manager	lt	14.0.0.5
big-ip_access_policy_manager	ge	14.1.0
big-ip_access_policy_manager	lt	14.1.0.6
big-ip_advanced_firewall_manager	ge	13.0.0
big-ip_advanced_firewall_manager	lt	13.1.1.5