F5 warned customers about a serious security flaw in BIG-IP that may lead to unauthorized remote code execution. An issue has been identified in the configuration utility component. It is assigned the CVE identifier CVE-2023-46747 and has a CVSS score of 9.8 out of 10.
F5 has stated that an unauthenticated attacker with network access to the BIG-IP system may be able to execute arbitrary system commands. This vulnerability only affects the control plane, not the data plane.
By infosecbulletin
/ Tuesday , September 17 2024
A recent dark web scan revealed that customer data from Dhaka Electric Supply Company Limited (DESCO) has been exposed. The...
Read More
By infosecbulletin
/ Monday , September 16 2024
Tenable Research found and fixed a remote code execution (RCE) vulnerability, called CloudImposer, in Google Cloud Platform (GCP). This flaw...
Read More
By infosecbulletin
/ Sunday , September 15 2024
In this article, we won’t dive too deep into the technical aspects of Capture The Flag (CTF) competitions. Instead, we...
Read More
By infosecbulletin
/ Sunday , September 15 2024
A recent Bitdefender report reveals that Medusa is still actively attacking and has created a notable presence on both the...
Read More
By infosecbulletin
/ Saturday , September 14 2024
Ivanti warned that a recently fixed security flaw in its Cloud Service Appliance (CSA) is being actively exploited. CVE-2024-8190 is...
Read More
By infosecbulletin
/ Saturday , September 14 2024
CISA issued 25 ICS advisories on September 12, 2024, detailing current security issues, vulnerabilities, and exploits in Industrial Control Systems....
Read More
By infosecbulletin
/ Friday , September 13 2024
Intel announced over 20 vulnerabilities in its processors and products in security advisories released on Tuesday. The chip giant has...
Read More
By infosecbulletin
/ Friday , September 13 2024
GitLab released security updates on Wednesday to fix 17 vulnerabilities, including a critical issue that lets attackers run pipeline jobs...
Read More
By infosecbulletin
/ Friday , September 13 2024
Fortinet confirmed a data breach after a threat actor claimed to have stolen 440GB of files from its Microsoft SharePoint...
Read More
By infosecbulletin
/ Thursday , September 12 2024
Indian Computer Emergency Response Team (CERT-In) issued a high-severity alert for android devices on September 11, 2024 highlighting the vulnerabilities...
Read More
The following versions of BIG-IP have been found to be vulnerable –
17.1.0 (Fixed in 17.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG)
16.1.0 – 16.1.4 (Fixed in 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG)
15.1.0 – 15.1.10 (Fixed in 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG)
14.1.0 – 14.1.5 (Fixed in 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG)
13.1.0 – 13.1.5 (Fixed in 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG)
F5 has provided a shell script for users of BIG-IP versions 14.1.0 and above as a mitigation. However, it should not be used on any BIG-IP version prior to 14.1.0 as it will cause the Configuration utility to not start.
Other temporary workarounds available for users are below –
To read read F5 Security Advisory click here.
ALSO READ:
CISCO Zero-Day Vulnerabilities exploitation in Bangladesh