Descripción
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de my.f5.com my.f5.com/manage/s/article/K000137353
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2023-46747
Otras vulnerabilidades de F5 en el catálogo
- CVE-2026-94127 Vulnerabilidad de desbordamiento de búfer en el heap en F5 BIG-IP APM Alta 22-09-2026
- CVE-2025-53521 Vulnerabilidad de desbordamiento de búfer en la pila en F5 BIG-IP Alta 27-03-2026
- CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability Alta 31-10-2023
- CVE-2022-1388 F5 BIG-IP Missing Authentication Vulnerability Alta 10-05-2022
- CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer Overflow Alta 18-01-2022