CVE-2019-6644
At a glance Severity Not available EPSS EPSS 1.40 % · percentile 72 (2026-10-27) State PUBLISHED Published 2019-09-04 Updated 2024-08-04 Assigner f5 NVD status Modified Description Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_local_traffic_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_local_traffic_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_advanced_firewall_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_advanced_firewall_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_application_acceleration_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_acceleration_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_analytics:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_analytics:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_access_policy_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_application_security_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_security_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_edge_gateway:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_edge_gateway:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_fraud_protection_service:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_fraud_protection_service:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_global_traffic_manager:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_global_traffic_manager:14.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 12.1.3 ≤ 12.1.4cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 13.0.0 ≤ 13.1.2cpe:2.3:a:f5:big-ip_link_controller:14.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_link_controller:14.1.0:*:*:*:*:*:*:*+12 more Affected products Product Versions BIG-IP affected 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4
References
Sources
