Vulnerabilidades en F5

421 resultados
Análisis Vexday

Com 404 CVEs catalogadas e taxa de exploração ativa 2,2 vezes acima da média geral do catálogo CISA KEV, os produtos F5 exigem atenção redobrada na priorização de correções. O destaque mais crítico é CVE-2022-1388, com escore EPSS de 0,9996 — indicando probabilidade extremamente alta de exploração ativa —, o que a posiciona como prioridade imediata de remediação. A presença de 8 CVEs com PoC pública e 9 de severidade crítica amplia a superfície de risco explorável, especialmente considerando que 59 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo relevante de descobertas recentes. O tipo de falha mais comum, CWE-476 (null pointer dereference), sugere oportunidades de melhoria estrutural no ciclo de desenvolvimento seguro, embora as explorações confirmadas tendam a concentrar-se nas falhas de controle de acesso e execução remota.

CVE-2022-1388CRITICALOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior EPSS 100.0%KEVCVE-2023-46747CRITICALBIG-IP Configuration utility unauthenticated remote code execution vulnerabilityEPSS 96.5%KEVCVE-2022-41622HIGHiControl SOAP vulnerabilityEPSS 92.3%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%CVE-2023-22374HIGHiControl SOAP vulnerabilityEPSS 72.6%CVE-2025-31644HIGHAppliance mode BIG-IP iControl REST and tmsh vulnerabilityEPSS 26.5%CVE-2024-45844HIGHBIG-IP monitors vulnerabilityEPSS 10.6%CVE-2024-26026HIGHBIG-IP Central Manager SQL InjectionEPSS 7.2%CVE-2025-20029HIGHBIG-IP iControl REST and tmsh vulnerabilityEPSS 7.1%CVE-2024-21793HIGHBIG-IP Central Manager OData Injection VulnerabilityEPSS 7.1%CVE-2023-46748HIGHBIG-IP Configuration utility authenticated SQL injection vulnerabilityEPSS 4.5%KEVCVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 3.4%CVE-2025-23419MEDIUMTLS Session Resumption VulnerabilityEPSS 2.8%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 2.7%CVE-2019-6631—On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by EPSS 2.5%CVE-2019-6623—On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server mEPSS 2.5%CVE-2023-41373HIGHBIG-IP Configuration Utility vulnerabilityEPSS 2.4%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 2.4%CVE-2025-53521CRITICALBigIP APM VulnerabilityEPSS 2.3%KEVCVE-2019-6617—On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role iEPSS 2.2%