CVE-2024-39778

When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge HSB, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028 BIG-IP Next Central Manager vulnerability

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-37028

CVE-2024-37028 affects BIG-IP Next Central Manager. An unauthenticated attacker can lock out a webUI account that has never been logged in (control-plane issue only; no data plane exposure). Affected: BIG-IP Next Central Manager 20.1.0–20.2.0; Fix: 20.2.1 (see F5 advisory K000139938). CVSS detail...

CVE-2024-37028 BIG-IP Next Central Manager vulnerability

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41727 BIG-IP TMM vulnerability

In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition VEs using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41719 BIG-IP Next Central Manager vulnerability

When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager CM, F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41719

CVE-2024-41719 affects BIG-IP Next Central Manager. When generating a QKView file of a BIG-IP Next instance from Central Manager, F5 iHealth credentials are logged in the BIG-IP Central Manager logs. The vulnerability is scoped to BIG-IP Next Central Manager (20.1.0–20.2.0 are listed as vulnerabl...

CVE-2024-41727

CVE-2024-41727 affects BIG-IP TMM on BIG-IP devices (and BIG-IP VE with Intel E810 SR-IOV NIC) where undisclosed traffic can cause memory resource utilization to spike, degrading performance or causing DoS. Public details specify the vulnerable components as the Traffic Management Microkernel (TM...

CVE-2024-41727 BIG-IP TMM vulnerability

In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition VEs using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-39809 BIG-IP Next Central Manager vulnerability

The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41719 BIG-IP Next Central Manager vulnerability

When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager CM, F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-39778 BIG-IP HSB vulnerability

When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge HSB, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-39778

CVE-2024-39778 affects BIG-IP platforms with High-Speed Bridge (HSB) where a stateless virtual server can be abused by undisclosed requests to cause TMM termination, causing DoS. Concrete details from connected sources show affected tracks per F5 advisories: BIG-IP Next (all modules) vulnerable; ...

CVE-2024-41164 BIG-IP MPTCP vulnerability

When TCP profile with Multipath TCP enabled MPTCP is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41723

CVE-2024-41723 affects BIG-IP iControl REST. A remote authenticated attacker with network access can view only usernames in the BIG-IP system via the iControl REST interface; there is no data plane exposure (control plane issue). Affected product versions are listed in F5 advisory: BIG-IP Next/ B...

CVE-2024-41723 BIG-IP iControl REST vulnerability

Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000140552: Quarterly Security Notification (August 2024)

Security Advisory Description On August 14, 2024, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K000140111: BIG-IP Next Central Manager vulnerability CVE-2024-39809

Security Advisory Description The BIG-IP Next Central Manager user session refresh token does not expire when a user logs out. CVE-2024-39809 Impact An attacker with access to obtain a user's session cookies can continue to use that session to access BIG-IP Next Central Manager and systems manage...

K000139938: BIG-IP Next Central Manager vulnerability CVE-2024-37028

Security Advisory Description BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. CVE-2024-37028 Impact An unauthenticated attacker can exploit this vulnerability to lock out a BIG-IP Next Central Manager webUI account that has never been logged...