CVE-2023-43746 BIG-IP Appliance mode external monitor vulnerability

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which...

CVE-2023-43611 BIG-IP Edge Client for macOS vulnerability

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43611

The CVE-2023-43611 entry concerns BIG-IP Edge Client for macOS privilege escalation during installation, linked to an incomplete fix for CVE-2023-38418. Affected products and components include BIG-IP APM edge client installation on macOS and the Edge Client installer. Impact is local privilege e...

CVE-2023-43611 BIG-IP Edge Client for macOS vulnerability

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485 BIGIP and BIG-IQ TACACS+ audit log Vulnerability

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485 BIGIP and BIG-IQ TACACS+ audit log Vulnerability

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485

CVE-2023-43485 describes an information disclosure in BIG-IP/BIG-IQ TACACS+ audit log forwarding where the shared secret is logged in plaintext. Connected advisories confirm impact: an authenticated attacker with auditor privileges can view the shared secret; there is no data plane exposure. Affe...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768

CVE-2023-42768 affects BIG-IP iControl REST privilege escalation. A non-admin user temporarily granted admin rights via iControl REST PUT can retain access to admin resources after reverting role, enabling control-plane access. According to F5 advisory K26910459, fixes are available: BIG-IP (all ...

CVE-2023-41964

The CVE-2023-41964 issue affects BIG-IP and BIG-IQ where two DB variables store sensitive values in plaintext (a proxy server password and a RADIUS/TACACS+ shared secret). The root cause is unencrypted storage of these values, enabling an authenticated attacker to access privileged information. R...

CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-41373

CVE-2023-41373 affects F5 BIG-IP, specifically the Configuration Utility, where a directory traversal flaw can let an authenticated attacker execute commands on the BIG-IP system. In Appliance mode, successful exploitation may cross a security boundary. The vulnerability is mapped to high/severe ...

CVE-2023-41373 BIG-IP Configuration Utility vulnerability

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software...

CVE-2023-41373 BIG-IP Configuration Utility vulnerability

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software...

CVE-2023-41253

CVE-2023-41253 affects BIG-IP DNS and BIG-IP LTM when DNS Services license is enabled. A TSIG key created on these systems is logged in plaintext in the audit log due to a disclosure in the control plane. The vulnerability can allow an authenticated user with auditor privileges to view the TSIG k...

CVE-2023-41253 BIG-IP DNS TSIG Key vulnerability

When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-41253 BIG-IP DNS TSIG Key vulnerability

When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-40542 BIG-IP TCP Profile vulnerability

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...