CVEvulnerability

CVE-2023-46747

9.8 CRITICAL Known exploited Published 2023-10-26 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability — F5 BIG-IP Configuration Utility

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

Added to KEV
2023-10-31
Remediation due
2023-11-21
Ransomware use
Known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://my.f5.com/manage/s/article/K000137353; https://nvd.nist.gov/vuln/detail/CVE-2023-46747
Status
Analyzed
Published
2023-10-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-288, CWE-306

Description

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected configurations

• f5 big-ip access policy manager (>= 13.1.0 <= 13.1.5) • f5 big-ip access policy manager (>= 14.1.0 <= 14.1.5) • f5 big-ip access policy manager (>= 15.1.0 <= 15.1.10) • f5 big-ip access policy manager (>= 16.1.0 <= 16.1.4) • f5 big-ip access policy manager (>= 17.1.0 <= 17.1.1) • f5 big-ip advanced firewall manager (>= 13.1.0 <= 13.1.5) • f5 big-ip advanced firewall manager (>= 14.1.0 <= 14.1.5) • f5 big-ip advanced firewall manager (>= 15.1.0 <= 15.1.10) • f5 big-ip advanced firewall manager (>= 16.1.0 <= 16.1.4) • f5 big-ip advanced firewall manager (>= 17.1.0 <= 17.1.1) • f5 big-ip advanced web application firewall (>= 13.1.0 <= 13.1.5) • f5 big-ip advanced web application firewall (>= 14.1.0 <= 14.1.5) • f5 big-ip advanced web application firewall (>= 15.1.0 <= 15.1.10) • f5 big-ip advanced web application firewall (>= 16.1.0 <= 16.1.4) • f5 big-ip advanced web application firewall (>= 17.1.0 <= 17.1.1) • f5 big-ip carrier-grade nat (>= 13.1.0 <= 13.1.5) • f5 big-ip carrier-grade nat (>= 14.1.0 <= 14.1.5) • f5 big-ip carrier-grade nat (>= 15.1.0 <= 15.1.10) • f5 big-ip carrier-grade nat (>= 16.1.0 <= 16.1.4) • f5 big-ip carrier-grade nat (>= 17.1.0 <= 17.1.1) • f5 big-ip ddos hybrid defender (>= 13.1.0 <= 13.1.5) • f5 big-ip ddos hybrid defender (>= 14.1.0 <= 14.1.5) • f5 big-ip ddos hybrid defender (>= 15.1.0 <= 15.1.10) • f5 big-ip ddos hybrid defender (>= 16.1.0 <= 16.1.4) • f5 big-ip ddos hybrid defender (>= 17.1.0 <= 17.1.1) • f5 big-ip ssl orchestrator (>= 13.1.0 <= 13.1.5) • f5 big-ip ssl orchestrator (>= 14.1.0 <= 14.1.5) • f5 big-ip ssl orchestrator (>= 15.1.0 <= 15.1.10) • f5 big-ip ssl orchestrator (>= 16.1.0 <= 16.1.4) • f5 big-ip ssl orchestrator (>= 17.1.0 <= 17.1.1) • f5 big-ip domain name system (>= 13.1.0 <= 13.1.5) • f5 big-ip domain name system (>= 14.1.0 <= 14.1.5) • f5 big-ip domain name system (>= 15.1.0 <= 15.1.10) • f5 big-ip domain name system (>= 16.1.0 <= 16.1.4) • f5 big-ip domain name system (>= 17.1.0 <= 17.1.1) • f5 big-ip local traffic manager (>= 13.1.0 <= 13.1.5) • f5 big-ip local traffic manager (>= 14.1.0 <= 14.1.5) • f5 big-ip local traffic manager (>= 15.1.0 <= 15.1.10) • f5 big-ip local traffic manager (>= 16.1.0 <= 16.1.4) • f5 big-ip local traffic manager (>= 17.1.0 <= 17.1.1) • f5 big-ip policy enforcement manager (>= 13.1.0 <= 13.1.5) • f5 big-ip policy enforcement manager (>= 14.1.0 <= 14.1.5) • f5 big-ip policy enforcement manager (>= 15.1.0 <= 15.1.10) • f5 big-ip policy enforcement manager (>= 16.1.0 <= 16.1.4) • f5 big-ip policy enforcement manager (>= 17.1.0 <= 17.1.1) • f5 big-ip automation toolchain (>= 13.1.0 <= 13.1.5) • f5 big-ip automation toolchain (>= 14.1.0 <= 14.1.5) • f5 big-ip automation toolchain (>= 15.1.0 <= 15.1.10) • f5 big-ip automation toolchain (>= 16.1.0 <= 16.1.4) • f5 big-ip automation toolchain (>= 17.1.0 <= 17.1.1) • f5 big-ip container ingress services (>= 13.1.0 <= 13.1.5) • f5 big-ip container ingress services (>= 14.1.0 <= 14.1.5) • f5 big-ip container ingress services (>= 15.1.0 <= 15.1.10) • f5 big-ip container ingress services (>= 16.1.0 <= 16.1.4) • f5 big-ip container ingress services (>= 17.1.0 <= 17.1.1) • f5 big-ip application security manager (>= 13.1.0 <= 13.1.5) • f5 big-ip application security manager (>= 14.1.0 <= 14.1.5) • f5 big-ip application security manager (>= 15.1.0 <= 15.1.10) • f5 big-ip application security manager (>= 16.1.0 <= 16.1.4) • f5 big-ip application security manager (>= 17.1.0 <= 17.1.1) … and 40 more

Related

Weakness · CWE (2)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References