CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-46747

CVSS 9.8v3.1pub. 2023-10-26upd. 2025-10-27

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

F5 Big Ip Access Policy Manager
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Advanced Firewall Manager
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Advanced Web Application Firewall
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Analytics
APP
F5
16.1.0 – 16.1.413.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1017.1.0 – 17.1.1
F5 Big Ip Application Acceleration Manager
APP
F5
16.1.0 – 16.1.413.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1017.1.0 – 17.1.1
F5 Big Ip Application Security Manager
APP
F5
13.1.0 – 13.1.517.1.0 – 17.1.116.1.0 – 16.1.415.1.0 – 15.1.1014.1.0 – 14.1.5
F5 Big Ip Application Visibility And Reporting
APP
F5
17.1.0 – 17.1.113.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.4
F5 Big Ip Automation Toolchain
APP
F5
17.1.0 – 17.1.116.1.0 – 16.1.415.1.0 – 15.1.1014.1.0 – 14.1.513.1.0 – 13.1.5
F5 Big Ip Carrier Grade Nat
APP
F5
13.1.0 – 13.1.517.1.0 – 17.1.116.1.0 – 16.1.415.1.0 – 15.1.1014.1.0 – 14.1.5
F5 Big Ip Container Ingress Services
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Ddos Hybrid Defender
APP
F5
17.1.0 – 17.1.113.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.4
F5 Big Ip Domain Name System
APP
F5
15.1.0 – 15.1.1017.1.0 – 17.1.116.1.0 – 16.1.414.1.0 – 14.1.513.1.0 – 13.1.5
F5 Big Ip Fraud Protection Services
APP
F5
17.1.0 – 17.1.116.1.0 – 16.1.413.1.0 – 13.1.515.1.0 – 15.1.1014.1.0 – 14.1.5
F5 Big Ip Global Traffic Manager
APP
F5
17.1.0 – 17.1.116.1.0 – 16.1.415.1.0 – 15.1.1014.1.0 – 14.1.513.1.0 – 13.1.5
F5 Big Ip Link Controller
APP
F5
17.1.0 – 17.1.113.1.0 – 13.1.516.1.0 – 16.1.415.1.0 – 15.1.1014.1.0 – 14.1.5
F5 Big Ip Local Traffic Manager
APP
F5
16.1.0 – 16.1.417.1.0 – 17.1.115.1.0 – 15.1.1014.1.0 – 14.1.513.1.0 – 13.1.5
F5 Big Ip Policy Enforcement Manager
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Ssl Orchestrator
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Webaccelerator
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1
F5 Big Ip Websafe
APP
F5
13.1.0 – 13.1.514.1.0 – 14.1.515.1.0 – 15.1.1016.1.0 – 16.1.417.1.0 – 17.1.1

CISA KEV — detailsi

Vendori: F5 ↗
Producti: BIG-IP Configuration Utility
Added to KEVi: October 31, 2023
Remediation deadline (US Federal)i: November 21, 2023(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory F5↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

🔴