F5 Networks BIG-IP : iControl REST vulnerability (K11742742)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5 / 14.1.4.5 / 15.1.5 / 16.1.2.1 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K11742742 advisory. Undisclosed requests by an authenticated iControl REST user can cause an increase in...

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services...

F5 Networks BIG-IP : Appliance Mode authenticated iControl REST vulnerability (K74151369)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4 / 14.1.4.2 / 15.1.3 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K74151369 advisory. - On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, an...

CVE-2021-23026

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...

Cross site request forgery (csrf)

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...

CVE-2021-23026

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...

CVE-2021-23026

Summary: CVE-2021-23026 affects F5 BIG-IP and BIG-IQ via a CSRF flaw in iControl SOAP that can trick authenticated users into performing actions on the control plane. The vulnerability affects multiple release lines (e.g., BIG-IP 16.0.x up to 16.0.1.2, 15.1.x up to 15.1.2, 14.1.x up to 14.1.4, 13...

CVE-2021-23026

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...

CVE-2021-23026: Cross-Site Request Forgery (CSRF)

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...

PT-2021-15351

Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.0.x through 16.0.1.1 BIG-IP versions 15.1.x through 15.1.2 BIG-IP versions 14.1.x through 14.1.4.1 BIG-IP versions 13.1.x through 13.1.4.0 BIG-IP version 12.1.x BIG-IP version 11.6.x BIG-IQ versions 8.x BIG-IQ versions 7.x...

F5 BIG-IP Advanced WAF and ASM MySQL database denial of service vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. The F5 BIG-IP Advanced WAF and ASM MySQL database denial of service vulnerability is associated with a policy on Virtul Serve...

F5 BIG-IP iControl SOAP CSRF Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A CSRF vulnerability exists in F5 BIG-IP iControl SOAP, which could be exploited by an attacker to potentially trick...

F5 BIG-IP Cross-Site Request Forgery Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A CSRF vulnerability exists in F5 BIG-IP iControl SOAP, which could be exploited by an attacker to potentially trick...

Authentication flaw

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints...

CVE-2021-23015

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints...

CVE-2021-23015

CVE-2021-23015 affects F5 BIG-IP when running in Appliance Mode. An authenticated user with the Administrator role may bypass Appliance Mode restrictions via undisclosed iControl REST endpoints. Impact is a control-plane bypass with no data-plane exposure; the vulnerability is mitigated by upgrad...

CVE-2021-23015: Incorrect Authorization

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints...

PT-2021-15342

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.0.8 through 13.1.3.6 F5 BIG-IP versions 14.1.x before 14.1.4.2 F5 BIG-IP versions 15.1.x before 15.1.3 F5 BIG-IP versions 16.0.x Description The issue allows an authenticated user with the 'Administrator' role to bypass...

F5 iControl Server-Side Request Forgery / Remote Command Execution Exploit

This Metasploit module exploits a pre-authentication server-side request forgery vulnerability in the F5 iControl REST API's /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that can be used to execute root commands on an affected BIG-IP or BIG-IQ device. This module requires...

F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated) Exploit

Exploit Title: F5 BIG-IP 16.0.x - iControl REST Remote Code Execution Unauthenticated Exploit Author: Al1ex Vendor Homepage: https://www.f5.com/products/big-ip-services Version: 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5....