Self-IP Port-Lockdown Bypass in F5 BIG-IP and BIG-IQ Products
CVE-2020-5923

5.4MEDIUM

Key Information:

Vendor
F5
Status
Big-ip, Big-iq
Vendor
CVE Published:
26 August 2020

Summary

This vulnerability allows an attacker to bypass the Self-IP port-lockdown feature by exploiting IPv6 link-local addresses. This misconfiguration in the affected versions of F5 BIG-IP and BIG-IQ products poses a security risk, as it may enable unauthorized access to sensitive network resources. Organizations using these products should apply the necessary updates to mitigate this risk effectively.

Affected Version(s)

BIG-IP, BIG-IQ BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1

BIG-IP, BIG-IQ BIG-IQ 5.4.0-7.0.0

References

https://support.f5.com/csp/article/K05975972
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.