F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 31/10/2023. Hãy vá các hệ thống bị ảnh hưởng ngay. Lỗ hổng này đã được dùng trong các chiến dịch ransomware.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| big-ip access policy manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 | |
| big-ip advanced firewall manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 | |
| big-ip advanced web application firewall | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 | |
| big-ip analytics | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 | |
| big-ip application acceleration manager | ≥ 13.1.0, ≤ 13.1.5 |
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1| big-ip application security manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip application visibility and reporting | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip automation toolchain | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip carrier-grade nat | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip container ingress services | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip ddos hybrid defender | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip domain name system | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip fraud protection services | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip global traffic manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip link controller | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip local traffic manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip policy enforcement manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip ssl orchestrator | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip webaccelerator | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |
| big-ip websafe | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1 |