CVE-2023-46747: critical vulnerability in F5 BIG-IP
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The BIG-IP configuration tool has a flaw that lets attackers skip the login requirement and run commands on the system if they can reach the management port. This is critical because it gives complete control without needing valid credentials.
An unauthenticated attacker with network access to BIG-IP management or self IP interfaces can bypass authentication checks in the configuration utility to achieve arbitrary command execution. The vulnerability requires no credentials and grants system-level privileges; exploitation is feasible over the network without prerequisites beyond port accessibility.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.