CVE-2021-23004
At a glance Severity Not available EPSS EPSS 1.00 % · percentile 62 (2026-10-27) State PUBLISHED Published 2021-03-31 Updated 2024-08-03 Assigner f5 NVD status Modified Description On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P NVD · nvd@nist.gov (Primary)
European references
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4+44 more Affected products Product Versions BIG-IP affected 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3
References
Sources
