BIG-IP APM Clients TunnelCrack vulnerability
CVE-2023-43125
8.2HIGH
Summary
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected Version(s)
BIG-IP Edge Client < 7.2.3
F5 Access < 3.0
CVSS V3.1
Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database
Credit
Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables https://papers.mathyvanhoef.com/usenix2023-tunnelcrack.pdf