Vulnerabilidades em F5 Networks, Inc.
140 resultadosAnálise Vexday
Com 140 CVEs catalogadas e nenhuma atualmente listada no CISA KEV, a F5 Networks apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere pressão imediata reduzida em termos de ameaças confirmadas em campo. Não há vulnerabilidades críticas nem registros recentes nos últimos 90 dias, indicando estabilidade no ritmo de descobertas recentes. A CVE mais relevante no momento é CVE-2018-5511, com score EPSS de 0,1476 — valor que, embora moderado, merece monitoramento dado o histórico de produtos F5 como alvos de interesse em ambientes corporativos. A existência de ao menos um PoC público reforça a importância de manter patches aplicados mesmo na ausência de exploração confirmada.
CVE-2018-15317—In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.2.1-11.6.3.2, an attacker sending specially crafted SSL records to a SSLEPSS 1.4%CVE-2018-15330—On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bombEPSS 1.3%CVE-2018-15318—In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow iEPSS 1.3%CVE-2018-5500—On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a smallEPSS 1.3%CVE-2016-9253—In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to EPSS 1.3%CVE-2018-15320—On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. TEPSS 1.3%CVE-2018-5501—In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile alloEPSS 1.3%CVE-2017-6147—In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responEPSS 1.3%CVE-2018-5502—On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certEPSS 1.3%CVE-2016-7475—Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not propEPSS 1.3%CVE-2017-6148—Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disrupEPSS 1.3%CVE-2017-6155—On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption EPSS 1.3%CVE-2019-6597—In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrativeEPSS 1.3%CVE-2018-15324—On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access.EPSS 1.3%CVE-2018-5543—The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which mEPSS 1.2%CVE-2019-6600—In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for adEPSS 1.2%CVE-2018-5542—F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.EPSS 1.2%CVE-2018-5528—Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7.EPSS 1.2%CVE-2018-5537—A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMEPSS 1.2%CVE-2018-15329—On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run comEPSS 1.2%