BIG-IP and BIG-IQ iControl SOAP vulnerability
CVE-2023-38419

4.3MEDIUM

Key Information:

Vendor: F5
Status: Big-ip; Big-iq
Vendor: CVE Published:; 2 August 2023

Summary

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Version(s)

BIG-IP 17.1.0 < 17.1.0.2

BIG-IP 16.1.0 < 16.1.3.5

BIG-IP 15.1.0 < 15.1.9.1

References

https://my.f5.com/manage/s/article/K000133472

vendor-advisory

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Aug 2, 2023
Vulnerability Reserved
Jul 17, 2023

Credit

F5 acknowledges Maksymilian Kubiak, Sławomir Zakrzewski and Karol Mazurek of AFINE Sp. z o.o. for bringing this issue to our attention and following the highest standards of coordinated disclosure.