A security vulnerability, reported by F5, presents the possibility of remote code execution without requiring authentication. This vulnerability is identified as CVE-2023-46747, with a CVSS score of 9.8. The issue was discovered on October 4, 2023, by Praetorian Michael Weber and Thomas Hendrickson.
Attackers can leverage this vulnerability to execute arbitrary system commands on the BIG-IP system through the management port and/or self-IP addresses, providing network access. It’s important to note that this is a control-plane issue and does not pose a risk to the data plane.
Affected F5 BIG-IP Versions and Released Fixes:
- 17.1.0: 17.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG
- 16.1.0 – 16.1.4: 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG
- 15.1.0 – 15.1.10: 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG
- 14.1.0 – 14.1.5: 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG
- 13.1.0 – 13.1.5: 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG
F5 recommends customers restrict internet access and provides fixes for the affected BIG-IP versions. Temporary measures are also suggested to reduce the risk.
