Rewterz Threat Advisory – Multiple F5 BIG-IP Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-46747 CVSS: 9.8

F5 BIG-IP could allow a remote attacker to execute arbitrary commands on the system, caused by a configuration utility authentication bypass flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary system commands on the system.

CVE-2023-46748 CVSS: 8.8

F5 BIG-IP is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the Configuration utility, which could allow the attacker to view, add, modify or delete information in the back-end database.

Impact

• Gain Access
• Data Manipulation

Indicators Of Compromise

CVE

• CVE-2023-46747
• CVE-2023-46748

Affected Vendors

F5

Affected Products

• F5 BIG-IP 13.1.0
• F5 BIG-IP 14.1.0
• F5 BIG-IP 15.1.0
• F5 BIG-IP 16.1.0
• F5 BIG-IP 13.1.5
• F5 BIG-IP 14.1.5
• F5 BIG-IP 17.1.0
• F5 BIG-IP 16.1.4
• F5 BIG-IP 15.1.10

Remediation

efer to F5 Security Advisory for patch, upgrade or suggested workaround information.

CVE-2023-46747

CVE-2023-46748