F5 Releases Security Update for Critical Vulnerability in BIG-IP
Security update addresses critical remote code execution (RCE) vulnerability in BIG-IP
Summary
Security update addresses critical remote code execution (RCE) vulnerability in BIG-IP
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
F5 have released a security update addressing a critical remote code execution (RCE) vulnerability within BIG-IP. This vulnerability has a CVSSv3 score of 9.8 and is being tracked as CVE-2023-46747.
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.
Exploitation in the wild for CVE-2023-46747
F5 have stated that this vulnerability has been observed being actively exploited in the wild.
Threat updates
| Date | Update |
|---|---|
| 1 Nov 2023 |
Exploitation in the wild for CVE-2023-46747
This article has been updated to reflect this change. |
| 31 Oct 2023 |
Exploitation proof-of-concept publicly released for CVE-2023-46747
This article has been updated to reflect this change. |
Remediation advice
Affected organisations are encouraged to review the F5 Security Advisory and apply any relevant updates or mitigations.
Definitive source of threat updates
Last edited: 1 November 2023 3:16 pm