CVE-2023-46748: high-severity vulnerability in F5 BIG-IP
BIG-IP Configuration utility authenticated SQL injection vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
An authenticated attacker with access to BIG-IP's configuration utility can inject malicious SQL commands to execute arbitrary system commands on the server. This is dangerous because it allows full control over the affected BIG-IP system.
SQL injection vulnerability in BIG-IP Configuration utility requires prior authentication and network access to management port or self IP addresses. Attacker can craft malicious SQL input to bypass query logic and execute arbitrary OS commands, resulting in complete system compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.