CVE-2023-46748
BIG-IP Configuration utility authenticated SQL injection vulnerability
At a glance Severity HIGH 8.8 Exploitation Known exploited (CISA KEV) · added 2023-10-31 Exploited per ENISA since 2023-10-31 EPSS EPSS 4.23 % · percentile 91 (2026-10-27) State PUBLISHED Published 2023-10-26 Updated 2025-10-21 Assigner f5 NVD status Analyzed Description An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which
may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H f5 CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · f5sirt@f5.com (Secondary) CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 15.1.0 ≤ 15.1.10cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.4cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.1+60 more Affected products Product Versions F5 · BIG-IP affected 17.1.0 < * ; affected 16.1.0 < * ; affected 15.1.0 < * ; affected 14.1.0 < * ; affected 13.1.0 < *
References
Sources
