CVE-2021-23006

On all 7.x and 6.x versions fixed in 8.0.0, undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

CVE-2021-23006

CVE-2021-23006 concerns a reflected cross-site scripting (XSS) vulnerability in undisclosed BIG-IQ pages. According to F5 advisory K30585021, affected BIG-IQ versions include 7.0.0–7.1.0 and 6.0.0–6.1.0, with fixes introduced in 8.0.0 for the BIG-IQ REST services. The issue can be triggered by cr...

CVE-2021-23005

On all 7.x and 6.x versions fixed in 8.0.0, when using a Quorum device for BIG-IQ high availability HA for automatic failover, BIG-IQ does not make use of Transport Layer Security TLS with the Corosync protocol. Note: Software versions which have reached End of Software Development EoSD are not...

CVE-2021-22997

The CVE-2021-22997 issue affects BIG-IQ High Availability (HA) with the ElasticSearch transport service. It lacks authentication and transmits ElasticSearch transport data unencrypted across 7.x/6.x (fixed in 8.0.0) and is rated High (CVSSv3 8.6). The Red Hat/Redacted and CNVD entries align on un...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

CVE-2021-22996

CVE-2021-22996 concerns a vulnerability in BIG-IQ where a DCD cluster member receiving an undisclosed message during auto failover may cause the corosync process to abort, leading to a DoS and impacting the HIGH-AVAIL stability of the BIG-IQ HA cluster. Affected: BIG-IQ Data Collection Device (DC...

CVE-2021-22996

On all 7.x versions fixed in 8.0.0, when set up for auto failover, a BIG-IQ Data Collection Device DCD cluster member that receives an undisclosed message may cause the corosync process to abort. This behavior may lead to a denial-of-service DoS and impact the stability of a BIG-IQ high...

CVE-2021-22995

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

CVE-2021-22995

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

Authentication flaw

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

CVE-2021-22995

CVE-2021-22995 concerns BIG-IQ high availability (HA) when using a Quorum device for automatic failover. The root cause is that the Corosync daemon authentication is not implemented, allowing unauthenticated interaction in affected setups. Applicable products: BIG-IQ HA configurations (7.x/6.x li...

CVE-2021-22995

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ high availability HA when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development EoSD are not evaluated...

CVE-2021-22986

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note...

Design/Logic Flaw

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note...

CVE-2021-22986

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note...

K03009991: iControl REST unauthenticated remote command execution vulnerability CVE-2021-22986

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

Vuln Impact This vulnerability allows for unauthenticated at...

Critical F5 BIG-IP Bug Under Active Attacks After PoC Exploit Posted Online

Almost 10 days after application security company F5 Networks released patches for critical vulnerabilities in its BIG-IP and BIG-IQ products, adversaries have begun opportunistically mass scanning and targeting exposed and unpatched networking devices to break into enterprise networks. News of i...

Critical F5 BIG-IP Bug Under Active Attacks After PoC Exploit Posted Online

Almost 10 days after application security company F5 Networks released patches for critical vulnerabilities in its BIG-IP and BIG-IQ products, adversaries have begun opportunistically mass scanning and targeting exposed and unpatched networking devices to break into enterprise networks. News of i...

F5, CISA Warn of Critical BIG-IP and BIG-IQ RCE Bugs

F5 Networks is warning users to patch four critical remote command execution RCE flaws in its BIG-IP and BIG-IQ enterprise networking infrastructure. If exploited, the flaws could allow attackers to take full control over a vulnerable system. The company released an advisory, Wednesday, on seven...