CVE-2023-46747 is a critical F5 BIG-IP vulnerability. An attacker with network access to the management port or self-IP addresses can bypass authentication and run arbitrary system commands, which means remote code execution. It has a CVSS score of 9.8. F5 has released hotfixes for BIG-IP versions 13.1 to 17.1, and CISA lists the flaw as exploited. Related reading: the F5 nation-state breach incident page.
What is the F5 BIG-IP remote code execution vulnerability?
A security vulnerability, reported by F5, presents the possibility of remote code execution without requiring authentication. This vulnerability is identified as CVE-2023-46747, with a CVSS score of 9.8.
How can attackers abuse CVE-2023-46747?
Attackers can leverage this vulnerability to execute arbitrary system commands on the BIG-IP system through the management port and/or self-IP addresses, providing network access. It’s important to note that this is a control-plane issue and does not pose a risk to the data plane.
Affected F5 BIG-IP Versions and Released Fixes:
- 17.1.0: 17.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG
- 16.1.0 – 16.1.4: 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG
- 15.1.0 – 15.1.10: 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG
- 14.1.0 – 14.1.5: 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG
- 13.1.0 – 13.1.5: 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG
What does F5 recommend?
F5 recommends customers restrict internet access and provides fixes for the affected BIG-IP versions. Temporary measures are also suggested to reduce the risk.