Security News > 2023 > October > F5 fixes BIG-IP auth bypass allowing remote code execution attacks
A critical vulnerability in the F5 BIG-IP configuration utility, tracked as CVE-2023-46747, allows an attacker with remote access to the configuration utility to perform unauthenticated remote code execution.
"This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands," reads F5's security bulletin.
As F5 BIG-IP devices are used by governments, Fortune 500 firms, banks, service providers, and major consumer brands, it is strongly advised to apply any available fixes or mitigations to prevent the exploitation of these devices.
As shown in the past, the F5 BIG-IP TMUI has been exposed in the past, allowing attackers to exploit vulnerabilities to wipe devices and gain initial access to networks.
ASUS routers vulnerable to critical remote code execution flaws.
VMware fixes critical code execution flaw in vCenter Server.
News URL
Related news
- OvrC Platform Vulnerabilities Expose IoT Devices to Remote Attacks and Code Execution (source)
- Critical WordPress Anti-Spam Plugin Flaws Expose 200,000+ Sites to Remote Attacks (source)
- Ongoing phishing attack abuses Google Calendar to bypass spam filters (source)
- Sophos Firewall vulnerable to critical remote code execution flaw (source)
- Sophos discloses critical Firewall remote code execution flaw (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-26 | CVE-2023-46747 | Missing Authentication for Critical Function vulnerability in F5 products Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | 9.8 |