Vulnerabilities in F5

421 results
Vexday analysis

Com 404 CVEs catalogadas e taxa de exploração ativa 2,2 vezes acima da média geral do catálogo CISA KEV, os produtos F5 exigem atenção redobrada na priorização de correções. O destaque mais crítico é CVE-2022-1388, com escore EPSS de 0,9996 — indicando probabilidade extremamente alta de exploração ativa —, o que a posiciona como prioridade imediata de remediação. A presença de 8 CVEs com PoC pública e 9 de severidade crítica amplia a superfície de risco explorável, especialmente considerando que 59 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo relevante de descobertas recentes. O tipo de falha mais comum, CWE-476 (null pointer dereference), sugere oportunidades de melhoria estrutural no ciclo de desenvolvimento seguro, embora as explorações confirmadas tendam a concentrar-se nas falhas de controle de acesso e execução remota.

CVE-2019-6614—On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode EPSS 1.4%CVE-2022-27634MEDIUMOn 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing aEPSS 1.4%CVE-2019-6630—On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances.EPSS 1.3%CVE-2019-6629—On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restarEPSS 1.3%CVE-2019-6637—On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can leadEPSS 1.3%CVE-2019-6628—On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-EPSS 1.3%CVE-2019-6624—On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual EPSS 1.3%CVE-2019-6634—On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads tEPSS 1.3%CVE-2019-6609—Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DEPSS 1.3%CVE-2022-34862HIGHTMM vulnerability CVE-2022-34862EPSS 1.3%CVE-2019-6672—On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platEPSS 1.2%CVE-2020-5852—Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affeEPSS 1.2%CVE-2025-54755MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 1.2%CVE-2022-41617HIGHBIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617EPSS 1.2%CVE-2023-28406MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 1.2%CVE-2019-6665—On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and EnterprisEPSS 1.1%CVE-2022-41742HIGHNGINX ngx_http_mp4_module vulnerability CVE-2022-41742EPSS 1.1%CVE-2019-6640—On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive confiEPSS 1.1%CVE-2019-6615—On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roleEPSS 1.1%CVE-2019-6681—On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding EPSS 1.1%