CVE-2024-41723

CVE-2024-41723 affects BIG-IP iControl REST. A remote authenticated attacker with network access can view only usernames in the BIG-IP system via the iControl REST interface; there is no data plane exposure (control plane issue). Affected product versions are listed in F5 advisory: BIG-IP Next/ B...

CVE-2024-41723: Exposure of Sensitive Information to an Unauthorized Actor

Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 A remote code execution vulnerability exi...

CVE-2024-22093 Appliance mode iControl REST vulnerability

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical...

CVE-2024-22093 Appliance mode iControl REST vulnerability

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical...

CVE-2024-22093

The CVE-2024-22093 issue affects BIG-IP in Appliance mode where an authenticated attacker can exploit an undisclosed iControl REST endpoint to perform remote command injection and cross the security boundary. Affected versions include BIG-IP Next/BIG-IP (all modules) on 17.x with fixes in 17.1.1,...

CVE-2024-22389

CVE-2024-22389 affects BIG-IP in HA deployments where updating an iControl REST API token fails to sync to the peer, a control-plane issue impacting confidentiality, integrity, and availability (CVSS v3.1 base 7.2). Affected releases and fixes: BIG-IP (all modules) vulnerable in 17.1.0; fix intro...

CVE-2024-22389 BIG-IP iControl REST API Vulnerability

When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000137522: BIG-IP iControl REST vulnerability CVE-2024-22093

Security Advisory Description When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. CVE-2024-22093 Impact This...

CVE-2024-22389: Insufficient Session Expiration

When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 Networks BIG-IP : BIG-IP iControl REST API vulnerability (K32544615)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K32544615 advisory. When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does no...

CVE-2024-22093: Improper Neutralization of Special Elements used in a Command

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical...

F5 Networks BIG-IP : BIG-IP iControl REST vulnerability (K000137522)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137522 advisory. - When running in appliance mode, an authenticated remote command injection vulnerability exists in an...

F5 Networks BIG-IP : BIG-IP iControl REST Privilege Escalation (K26910459)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.0 / 16.1.4 / 15.1.9. It is, therefore, affected by a vulnerability as referenced in the K26910459 advisory. The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Not...

CVE-2023-42768

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768

CVE-2023-42768 affects BIG-IP iControl REST privilege escalation. A non-admin user temporarily granted admin rights via iControl REST PUT can retain access to admin resources after reverting role, enabling control-plane access. According to F5 advisory K26910459, fixes are available: BIG-IP (all ...

PT-2023-28578 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: The issue occurs when a non-admin user is assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration...

CVE-2023-42768: Insufficient Session Expiration

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...