Pierluigi Paganini October 27, 2023

F5 warns customers of a critical vulnerability impacting BIG-IP that could lead to unauthenticated remote code execution.

F5 is warning customers about a critical security vulnerability, tracked as CVE-2023-46747 (CVSS 9.8), that impacts BIG-IP and could result in unauthenticated remote code execution.

The vulnerability resides in the configuration utility component, it was by Michael Weber and Thomas Hendrickson of Praetorian on October 4, 2023.

“This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There is no data plane exposure; this is a control plane issue only.” reads the published by F5.

The vulnerability affects the following versions:

F5 has released a shell script for versions 14.1.0 and later. The company pointed out that the script must not be used on any BIG-IP version prior to 14.1.0 because it will prevent the Configuration utility from starting.

“Until it is possible to install a fixed version, you can use the following sections as temporary mitigations.” continues the advisory. “These mitigations restrict access to the Configuration utility to only trusted networks or devices, thereby limiting the attack surface.

• “

“As a result of our research we were able to identify an authentication bypass issue that led to complete compromise of an F5 system with the Traffic Management User Interface (TMUI) exposed. The bypass was assigned , and is closely related to .” the analysis published by Praetorian. “While the issue we highlighted in the F5 TMUI portal was a critical risk issue and an unknown vulnerability, you can still take steps to protect yourself. After the two previous RCEs in the TMUI service, the interface itself should not be exposed to the Internet in the first place. “

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, F5 BIG-IP)