F5-BIG-IP-RCE-CVE-2022-1388

CVE-2022-1388 F5 BIG-IP RCE 多线程检测 use： root@kitploit: 单个url: python3 CVE-2022-1388.py -u https://xxx.xxx.xxx.xxx 批量多线程: python3 CVE-2022-1388.py -f url.txt 执行命令: python3 CVE-2022-1388.py -u https://xxx.xxx.xxx.xxx -c whoami result:...

CVE-2020-5902

摘要 在 BIG-IP 版本 15.0.0-15.1.0.3、14.1.0-14.1.2.5、13.1.0-13.1.3.3、12.1.0-12.1.5.1 和 11.6.1-11.6.5.1 中，流量管理用户界面（TMUI，也称为配置实用程序）在未公开的页面中存在远程代码执行（RCE）漏洞。 致谢：Positive Technologies 的 Mikhail Klyuchnikov 概念验证 root@kitploit: https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/pass...

CVE-2022-1388-Scanner

F5 CVE-2022-1388 扫描器 BIG-IP iControl REST 漏洞 CVE-2022-1388 扫描器 用法 root@kitploit: pip install -r requirements.txt pytohn3 CVE-2022-1388-Scanner.py 请求 root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: REDACTED:8083 Content-Length: 45 Connection: Keep-Alive, X-F5-Auth-Token Cache-Control:...

test_cve-2023-46747

用于测试 F5 BIG-IP 是否存在 CVE-2023-46747 漏洞的 Python 脚本。如果存在漏洞，则会添加一个具有管理员权限的用户账户。 要缓解此漏洞，请参阅：https://my.f5.com/manage/s/article/K000137353...

CVE-202122986-EXP

F5 BIG-IP Vulnerabilidad de ejecución remota de comandos CVE-2021-22986 Impacto de la vulnerabilidad F5 BIG-IP 16.x: 16.1.0.3 F5 BIG-IP 15.x: 15.1.0.4 F5 BIG-IP 14.x: 14.1.2.6 F5 BIG-IP 13.x: 13.1.3.4 F5 BIG-IP 12.x: 12.1.5.2 F5 BIG-IP 11.x: 11.6.5.2 fofa iconhash="-335242539" POC root@kitploit:...

CVE-2020-5902

CVE-2020-5902 用于检查 CVE-2020-5902（F5 BIG-IP 设备）的 Python 脚本。 用法 root@kitploit: python3 CVE-2020-5902.py -i 输出 root@kitploit: - 用于检查 CVE-2020-5902（F5 BIG-IP 设备）的 Python 脚本。 | 由 Abdullah AlZahrani 编写 ! 你的目标：127.0.0.1 I /etc/passwd 可读 PoC...

CVE-2022-1388

CVE-2022-1388 针对影响F5 BIG-IP的CVE-2022-1388的PoC。 用法 root@kitploit: $ ./poc.sh --help Usage: poc.sh --help --file FILE --scan --exploit --payload PAYLOAD CVE-2022-1388 PoC script. One or multiple IPs can be scanned. Arguments: --help Show this help message and exit. --file FILE File list containing...

CVE-2020-5902-F5BIG

CVE-2020-5902-F5BIG 只需像这样运行命令 👇 root@kitploit: go run CVE-2020-5902-F5BIG-Scanner.go -u ... -p 443 -m R -f /etc/issue or go run CVE-2020-5902-F5BIG-Scanner.go -u ... -p 443 -m C...

F5 Networks BIG-IP : BIND vulnerability (K000163212)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163212 advisory. If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for...

CVE-2026-63020

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

CVE-2026-66842

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...

EUVD-2026-70136

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...

EUVD-2026-70135

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

CVE-2026-66842 BIG-IP and BIG-IQ Configuration utility vulnerability

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...

CVE-2026-63020

CVE-2026-63020 is a CWE-451 (UI Misrepresentation of Critical Information) vulnerability in the BIG-IP Configuration utility web interface. An attacker can trick authenticated users into clicking malicious links, causing a spoofed error message to be reflected in the victim's browser session. Thi...

CVE-2026-66842

CVE-2026-66842 affects F5 BIG-IP (all modules) and BIG-IQ Centralized Management , allowing any authenticated user to create administrative accounts via an undisclosed request to the Configuration utility (TMUI) . F5 classified the root cause as CWE-918 (Server-Side Request Forgery) . The vulnera...

K000162872: Out-of-band Security Notification (September 2, 2026)

Security Advisory Description On September 2, 2026, F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K000162521: BIG-IP and BIG-IQ Configuration utility vulnerability CVE-2026-66842

Security Advisory Description BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to the Configuration utility. CVE-2026-66842 Impact This vulnerability may allow an authenticated attacker with networ...

K000161728: BIG-IP Configuration utility vulnerability CVE-2026-63020

Security Advisory Description A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. CVE-2026-63020 Impact An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in...

PT-2026-84761

Name of the Vulnerable Software and Affected Versions BIG-IP affected versions not specified BIG-IQ affected versions not specified Description An authenticated user with any role can escalate privileges by creating administrative user accounts. This is achieved through an undisclosed request sen...