Undisclosed Requests May Bypass Configuration Utility Authentication in F5 BIG-IP Systems, Allowing Attackers to Execute Arbitrary System Commands
Key Information
- Vendor
- F5
- Status
- BIG-IP
- Vendor
- CVE Published:
- 26 October 2023
Badges
Summary
The vulnerability CVE-2023-46747 in F5 BIG-IP systems allows for the bypass of configuration utility authentication, enabling attackers to execute arbitrary system commands. This critical-severity unauthenticated remote code execution flaw affects several versions of the BIG-IP security appliances, with a CVSS v3 score of 9.8 out of 10. Threat actors have been observed using this vulnerability to exploit CVE-2023-46748, a related authenticated SQL injection vulnerability. This exploitation poses a control plane issue only and does not expose the data plane. The security firm Mandiant has attributed this critical-severity vulnerability to a China-linked threat cluster, linking it to a series of aggressive cyberattack campaigns targeting various organizations in Southeast Asia and the US. These attacks involve the delivery of custom malware capable of delivering additional backdoors on compromised Linux hosts, emphasizing the significance and potential impact of the vulnerability. This underscores the urgency of applying the released patches and implementing necessary mitigations to protect against potential exploitation.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-46747 as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
BIG-IP < 17.1.0
BIG-IP < 16.1.0
BIG-IP < 15.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
F5 Patches Remote Code Execution Bug in BIG-IP
The critical-severity, unauthenticated remote code execution flaw exists in several versions of the F5 BIG-IP security appliances.
7 months ago
China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws
China-linked threat group aggressively exploits software flaws in Connectwise ScreenConnect & F5 BIG-IP.
8 months ago
Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect
During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in...
8 months ago
EPSS Score
97% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
Vulnerability started trending.
- 👾
Exploit exists.
First article discovered by The Hacker News
Vulnerability published.
Vulnerability Reserved.