CVE-2024-22093
Appliance mode iControl REST vulnerability
En bref Sévérité HIGH 8.7 EPSS EPSS 0.83 % · centile 58 (2026-10-27) État PUBLISHED Publiée 2024-02-14 Mise à jour 2025-05-02 Attribuée par f5 Statut NVD Analyzed Description When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N f5 CVSS 3.1 HIGH 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N NVD · f5sirt@f5.com (Secondary) CVSS 3.1 HIGH 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.3.0cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_analytics:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_link_controller:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.9cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.4cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.0:*:*:*:*:*:*:*Produits affectés Produit Versions F5 · BIG-IP affected 17.1.0 < 17.1.1 ; affected 16.1.0 < 16.1.4 ; affected 15.1.0 < 15.1.9
Références
Sources
