New High-Severity Vulnerabilities Discovered in Cisco IOx and F5 BIG-IP Products

F5 has warned of a high-severity flaw impacting BIG-IP appliances that could lead to denial-of-service DoS or arbitrary code execution. The issue is rooted in the iControl Simple Object Access Protocol SOAP interface and affects the following versions of BIG-IP - 13.1.5 14.1.4.6 - 14.1.5 15.1.5.1...

CVE-2023-22374

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

Format string

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374 iControl SOAP vulnerability

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374 iControl SOAP vulnerability

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374

CVE-2023-22374 affects F5 BIG-IP iControl SOAP with a format-string vulnerability that can crash the iControl SOAP CGI process or allow potentially arbitrary command execution for authenticated attackers. Affected BIG-IP branches and vulnerable versions (per K000130415): 17.x (17.0.0) fixed in 17...

CVE-2023-22326 iControl REST and tmsh vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

CVE-2023-22326

Vulnerability CVE-2023-22326 affects BIG-IP iControl REST and tmsh dig command. An authenticated attacker with resource administrator or administrator privileges can view sensitive information due to incorrect permission assignments in versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1...

CVE-2023-22326 iControl REST and tmsh vulnerability

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

K000130415: iControl SOAP vulnerability CVE-2023-22374

Security Advisory Description A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to...

K83284425: iControl REST and tmsh vulnerability CVE-2023-22326

Security Advisory Description Incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which may allow an authenticated attacker with resource administrator role privilege to view sensitive information. CVE-2023-22326 Impact An authenticated...

F5 BIG-IP 格式化字符串错误漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in F5 iControl SOAP, which can be exploited by an authenticated attacker to...

F5 iControl SOAP elevation of privilege vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in F5 iControl SOAP, which can be exploited by an authenticated attacker to...

K55879220: Overview of F5 vulnerabilities (May 2022)

Security Advisory Description On May 4, 2022, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K13325942: Appliance mode iControl REST vulnerability CVE-2022-41800

Security Advisory Description When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary...

K97843387: Overview of F5 vulnerabilities (November 2022)

Security Advisory Description On November 16, 2022, F5 announced the following issues. This document is intended to serve as an overview of these issues to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Distributed Cloud and Manage...

K94221585: iControl SOAP vulnerability CVE-2022-41622

Security Advisory Description BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. CVE-2022-41622 Impact An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl...

CVE-2022-41622

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...