CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2023-38419

CVE-2023-38419 affects F5 BIG-IP and BIG-IQ iControl SOAP. An authenticated attacker with guest or higher privileges can cause the iControl SOAP daemon to terminate/cease responding by sending undisclosed requests (DoS). Affected branches and fixes include: BIG-IP 17.x vulnerable (versions 17.0.0...

CVE-2019-10744

CVE-2019-10744 affects lodash versions lower than 4.17.12 and enables Prototype Pollution via defaultsDeep, by injecting a constructor payload to modify Object.prototype. IBM X-Force lists a base3.1 score of 9.1 (CRITICAL) and confirms the prototype pollution impact. Remediation: upgrade lodash t...

CVE-2023-46747

CVE-2023-46747 is an unauthenticated remote code execution flaw in F5 BIG-IP TMUI (management port/self IP). Public linked PoCs/exploits demonstrate unauthenticated RCE by targeting TMUI to create or leverage a user/token flow and execute commands on vulnerable devices; CVSS v3.1 = 9.8 (CRITICAL)...

CVE-2002-20001

CVE-2002-20001 describes a Diffie-Hellman key exchange weakness where a remote attacker (from the client side) can send non-public values to induce expensive server-side DHE modular-exponentiation, potentially impacting availability. The description specifies that the attack is most disruptive wh...

CVE-2023-46748

CVE-2023-46748 is an authenticated SQL injection vulnerability in F5 BIG-IP’s Configuration utility. An attacker with network access via the BIG-IP management port and/or self IPs can execute arbitrary system commands through the vulnerable Configuration utility. Affected BIG-IP versions include ...

CVE-2025-31644

CVE-2025-31644 affects BIG-IP in Appliance mode. An authenticated administrator can exploit command injection via iControl REST and the tmsh shell to execute arbitrary system commands, potentially gaining root access. The advisory K000148591 provides fixes for affected branches: upgrade to BIG-IP...

CVE-2025-20029

CVE-2025-20029 is a command-injection vulnerability in BIG-IP iControl REST and the tmsh shell. An authenticated user could execute arbitrary system commands, e.g., via a crafted HTTP POST to the iControl REST endpoint /mgmt/tm/util/bash with a JSON payload such as {"command": "id"}, potentially ...

CVE-2023-41373

CVE-2023-41373 affects F5 BIG-IP, specifically the Configuration Utility, where a directory traversal flaw can let an authenticated attacker execute commands on the BIG-IP system. In Appliance mode, successful exploitation may cross a security boundary. The vulnerability is mapped to high/severe ...

CVE-2024-45844

CVE-2024-45844 affects F5 BIG-IP monitors vulnerability. The issue allows an authenticated attacker with Manager-level privileges (via Configuration utility or tmsh) to elevate privileges or modify configuration due to a monitor feature flaw. Affected BIG-IP versions and fixes: 15.1.x up to 15.1....

CVE-2026-40629

CVE-2026-40629 affects BIG-IP SSL/TLS when SSL profiles are configured on a virtual server. The issue can cause the virtual server to stop processing new client connections, effectively a DoS for new connections. The F5 advisory confirms this is a data plane issue; no control plane exposure. Miti...

CVE-2023-40534

CVE-2023-40534 affects F5 BIG-IP HTTP/2 in multiple branches. When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled on a virtual server, and an iRule using HTTP_REQUEST or a Local Traffic Policy is attached, undisclosed requests can cause the Traffic Management Microkernel ...

CVE-2023-43746

CVE-2023-43746 affects BIG-IP appliances running in Appliance mode. An authenticated Administrator can bypass Appliance mode restrictions via the BIG-IP external monitor, enabling a cross-boundary impact with a CVSSv3 of 8.7 (Network, Privileges Required: High, User Interaction: None, Confidentia...

CVE-2023-41964

The CVE-2023-41964 issue affects BIG-IP and BIG-IQ where two DB variables store sensitive values in plaintext (a proxy server password and a RADIUS/TACACS+ shared secret). The root cause is unencrypted storage of these values, enabling an authenticated attacker to access privileged information. R...

CVE-2026-41225

CVE-2026-41225 affects F5 BIG-IP iControl REST. A highly privileged, authenticated user (Manager) can create configuration objects that execute arbitrary commands. Impact is control-plane–level: privilege escalation and possible cross-boundary access in appliances; data plane remains unaffected p...

CVE-2024-39778

CVE-2024-39778 affects BIG-IP platforms with High-Speed Bridge (HSB) where a stateless virtual server can be abused by undisclosed requests to cause TMM termination, causing DoS. Concrete details from connected sources show affected tracks per F5 advisories: BIG-IP Next (all modules) vulnerable; ...

CVE-2023-43611

The CVE-2023-43611 entry concerns BIG-IP Edge Client for macOS privilege escalation during installation, linked to an incomplete fix for CVE-2023-38418. Affected products and components include BIG-IP APM edge client installation on macOS and the Edge Client installer. Impact is local privilege e...

CVE-2024-41727

CVE-2024-41727 affects BIG-IP TMM on BIG-IP devices (and BIG-IP VE with Intel E810 SR-IOV NIC) where undisclosed traffic can cause memory resource utilization to spike, degrading performance or causing DoS. Public details specify the vulnerable components as the Traffic Management Microkernel (TM...

CVE-2025-41414

Summary of CVE-2025-41414 (BIG-IP HTTP/2 vulnerability) Issue: When HTTP/2 client and server profiles are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate, resulting in DoS via traffic disruption as the TMM restarts. This is a da...

CVE-2023-3470

CVE-2023-3470 affects specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards, where the Crypto User password is deterministic. This enables an authenticated user with tmsh access (or someone with physical access to the FIPS HSM) to derive the correct password, potentially compromising con...

CVE-2025-21087

CVE-2025-21087 affects F5 BIG-IP TMM: when Client/Server SSL profiles are configured on a virtual server or DNSSEC signing is used, undisclosed traffic can cause increased memory and CPU usage, potentially degrading performance or causing DoS. According to the F5 advisory, vulnerable ranges inclu...

CVE-2022-41983

CVE-2022-41983 describes a BIG-IP TMM vulnerability where, on certain hardware with Intel QAT and AES-GCM/CCM, data may be sent unencrypted despite an SSL profile. Affected BIG-IP branches: 16.x (vuln up to 16.1.3; fix in 16.1.3.1), 15.x (up to 15.1.6; fix in 15.1.7), 14.x (up to 14.1.5; fix in 1...

CVE-2026-34176

CVE-2026-34176 affects BIG-IP in Appliance mode and is described in F5 advisories K000160857/K000160857 (appliance-mode iControl REST vulnerability). An authenticated attacker with administrator privileges and network access can trigger an OS command injection via an undisclosed iControl REST end...

CVE-2023-40537

CVE-2023-40537 affects BIG-IP on multi-blade VIPRION: an authenticated user’s session cookie may remain valid briefly after logout, enabling potential reuse to access management interfaces and execute commands. The vulnerability is limited to VIPRION multi-blade configurations and does not affect...

CVE-2024-31156

CVE-2024-31156 is an XSS vulnerability in the BIG-IP Configuration utility. A stored XSS flaw allows JavaScript execution in the context of the currently logged-in user via an undisclosed page. CVSSv3.1 base score 8.0 (HIGH) with Network attack vector, Low attack complexity, Privileges required: ...

CVE-2023-41085

CVE-2023-41085 affects F5 BIG-IP when IPSec is configured on a Virtual Server. Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS on the BIG-IP system (data plane issue; no control plane exposure). Vulnerable ranges include BIG-IP Next/Classic ...

CVE-2023-38138

CVE-2023-38138 affects BIG-IP Configuration utility pages and is a reflected XSS vulnerability that can execute JavaScript in the context of the currently logged-in user. Public documentation in connected sources confirms impact on BIG-IP (Configuration utility) and that exploitation could lead t...

CVE-2023-42768

CVE-2023-42768 affects BIG-IP iControl REST privilege escalation. A non-admin user temporarily granted admin rights via iControl REST PUT can retain access to admin resources after reverting role, enabling control-plane access. According to F5 advisory K26910459, fixes are available: BIG-IP (all ...

CVE-2024-25560

CVE-2024-25560 affects F5 BIG-IP AFM/TMM: when a DNS profile is applied to a virtual server, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to DoS. The advisory K000139037 lists affected branches and fixes: BIG-IP (all modules) 17.x (17.1.0 vulner...

CVE-2024-27202

CVE-2024-27202 is a DOM-based XSS in the BIG-IP Configuration utility. Affected BIG-IP versions include 17.1.0–17.1.1, 16.1.0–16.1.4, and 15.1.0–15.1.10. An attacker can run JavaScript in the context of an authenticated admin session via a malicious page, a control-plane issue with no data-plane ...

CVE-2025-21091

CVE-2025-21091 affects F5 BIG-IP SNMP when SNMPv1/v2c is disabled. The vulnerability can cause a DoS by increasing memory usage through undisclosed requests. According to the advisory, fixes are available in specific branches: for BIG-IP (all modules) the fix was introduced in 17.1.2 (vulnerable:...

CVE-2023-43485

CVE-2023-43485 describes an information disclosure in BIG-IP/BIG-IQ TACACS+ audit log forwarding where the shared secret is logged in plaintext. Connected advisories confirm impact: an authenticated attacker with auditor privileges can view the shared secret; there is no data plane exposure. Affe...

CVE-2024-41164

CVE-2024-41164 affects BIG-IP when a TCP profile with Multipath TCP (MPTCP) is configured on a Virtual Server. Undisclosed traffic and conditions outside the attacker’s control can cause the Traffic Management Microkernel (TMM) to terminate, resulting in DoS. MODE C documents concrete details fro...

CVE-2025-24320

CVE-2025-24320 is a stored XSS vulnerability in the BIG-IP Configuration utility. It arises from an incomplete fix for CVE-2024-31156. Affected: BIG-IP Configuration utility (across multiple tracks/branches). Impact: allows an attacker to store and execute JavaScript in the context of the logged-...

CVE-2023-40542

CVE-2023-40542 affects F5 BIG-IP: when TCP Verified Accept is enabled on a TCP profile configured on a virtual server, undisclosed requests can cause unbounded memory growth, degrading system performance and potentially triggering a denial of service as the TMM process restarts. The advisory (K00...

CVE-2024-28889

CVE-2024-28889 affects F5 BIG-IP SSL when an SSL profile with alert timeout is set to a non-default value, causing the Traffic Management Microkernel (TMM) to terminate and disrupt traffic (DoS). Affected branches and fixes per K000138912: BIG-IP (all modules) 17.1.0–17.1.1 vulnerable; fixed in 1...

CVE-2024-33608

CVE-2024-33608 affects F5 BIG-IP IPsec vulnerability. When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS on the BIG-IP data plane. CVSS v3.1 score is 7.5 (NETWORK, LOW attack complexity, no user int...

CVE-2026-42937

CVE-2026-42937 affects BIG-IP and BIG-IQ, with incorrect permission assignments in TMOS Shell (tmsh) for arp/ndp and in iControl REST. An authenticated attacker can view adjacent network information via remote iControl REST or local tmsh, a purely control-plane issue with no data-plane exposure. ...

CVE-2023-45219

CVE-2023-45219 is a BIG-IP tmsh information disclosure vulnerability. An authenticated user with resource administrator privileges can view sensitive information via an undisclosed tmsh command. Affected versions: BIG-IP (all modules) 16.1.0–16.1.3, 15.1.0–15.1.8, 14.1.0–14.1.5. Fixes: 16.1.4 (16...

CVE-2025-41433

CVE-2025-41433 affects F5 BIG-IP SIP MRF ALG profile. When configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate, enabling a potential DoS. Affected product scope per vendor advisories includes BIG-IP (all modules) acr...

CVE-2024-41723

CVE-2024-41723 affects BIG-IP iControl REST. A remote authenticated attacker with network access can view only usernames in the BIG-IP system via the iControl REST interface; there is no data plane exposure (control plane issue). Affected product versions are listed in F5 advisory: BIG-IP Next/ B...

CVE-2023-27378

CVE-2023-27378 affects BIG-IP Configuration utility with multiple reflected XSS in undisclosed pages. Affected versions include BIG-IP (all modules): 17.0.0–17.1.0, 16.1.0–16.1.3, 15.1.0–15.1.8, 14.1.0–14.1.5, and 13.x. Fixes introduced in 17.1.0.1 (for 17.x), 16.1.3.4 (for 16.x), 15.1.8.2 (for 1...

CVE-2025-41399

CVE-2025-41399 affects BIG-IP products when a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, causing undisclosed requests to increase memory resource utilization and potentially degrade performance or cause DoS via a reset/restart of the TMM process. The Re...

CVE-2026-41957

CVE-2026-41957 affects the BIG-IP and BIG-IQ Configuration utility. The connected advisory confirms an authenticated remote code execution vulnerability via undisclosed vectors in the Configuration utility (control plane access), with CWE-502 deserialization noted in the security advisory details...

CVE-2025-20045

CVE-2025-20045 affects F5 BIG-IP SIP ALG profile vulnerability where a SIP ALG Passthru Mode plus SIP router ALG on a Message Routing virtual server can cause Traffic Management Microkernel (TMM) termination, leading to DoS. The issue is documented across multiple sources (NVD, Red Hat, CVE listi...

CVE-2025-20058

CVE-2025-20058 affects BIG-IP: when a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can trigger increased memory usage, potentially degrading system performance and causing DoS via TMM. The F5 K000140947 advisory details affected branches and fixes: BIG-IP ...

CVE-2025-36504

CVE-2025-36504 affects BIG-IP when an HTTP/2 httprouter profile is configured on a virtual server. The issue can cause undisclosed responses that lead to increased memory/resource utilization, potentially degrading performance and causing DoS-like impact on the BIG-IP system. Security advisory K0...

CVE-2026-42409

CVE-2026-42409 affects BIG-IP: when an HTTP/2 profile is used with an iRule containing HTTP::redirect or HTTP::respond on a virtual server, undisclosed requests can crash the Traffic Management Microkernel (TMM), causing DoS. Evidence in connected docs shows affected products: BIG-IP (all modules...

CVE-2023-29163

Summary: CVE-2023-29163 affects F5 BIG-IP’s UDP profile when Idle Timeout is set to Immediate or 0, causing the Traffic Management Microkernel (TMM) to terminate and potentially DoS the system. The issue is a data-plane vulnerability that disrupts traffic as TMM restarts; exploitation is remote a...

CVE-2026-40698

CVE-2026-40698 affects BIG-IP and BIG-IQ where a highly privileged, authenticated user (Resource Administrator) can create SNMP configuration objects via iControl REST or tmsh, enabling privilege escalation. The connected advisory documents concrete details on affected products/versions and the u...