March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Update – DoNot APT Group Targets Pakistan and Afghanistan with New Firebird Backdoor
October 26, 2023
Rewterz Threat Advisory – ICS: Multiple Rockwell Automation Vulnerabilities
October 27, 2023
Rewterz Threat Update – DoNot APT Group Targets Pakistan and Afghanistan with New Firebird Backdoor
October 26, 2023
Rewterz Threat Advisory – ICS: Multiple Rockwell Automation Vulnerabilities
October 27, 2023
Severity
High
Analysis Summary
CVE-2023-46747 CVSS: 9.8
F5 BIG-IP could allow a remote attacker to execute arbitrary commands on the system, caused by a configuration utility authentication bypass flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary system commands on the system.
CVE-2023-46748 CVSS: 8.8
F5 BIG-IP is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the Configuration utility, which could allow the attacker to view, add, modify or delete information in the back-end database.
Impact
- Gain Access
- Data Manipulation
Indicators Of Compromise
CVE
- CVE-2023-46747
- CVE-2023-46748
Affected Vendors
F5
Affected Products
- F5 BIG-IP 13.1.0
- F5 BIG-IP 14.1.0
- F5 BIG-IP 15.1.0
- F5 BIG-IP 16.1.0
- F5 BIG-IP 13.1.5
- F5 BIG-IP 14.1.5
- F5 BIG-IP 17.1.0
- F5 BIG-IP 16.1.4
- F5 BIG-IP 15.1.10
Remediation
efer to F5 Security Advisory for patch, upgrade or suggested workaround information.