F5
F5 Big-ip Advanced Firewall Manager: vulnerabilidades y CVE
F5 Big-ip Advanced Firewall Manager tiene 552 vulnerabilidades publicadas, 59 de ellas en los últimos 12 meses. 34 son críticas y 11 figuran en el catálogo de explotación activa de CISA.
CVE552
Últimos 12 meses59
Críticas34
Explotadas activamente11
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2018-14634 | Alta (7.8) | 15% | ⚠ Explotación activa | 25 sept 2018 | An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on… |
| CVE-2023-46747 | Crítica (9.8) | 97% | ⚠ Explotación activa | 26 oct 2023 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system… |
| CVE-2023-46748 | Alta (8.8) | 4.5% | ⚠ Explotación activa | 26 oct 2023 | An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port… |
| CVE-2023-44487 | Alta (7.5) | 100% | ⚠ Explotación activa | 10 oct 2023 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2014-0196 | Media (5.5) | 22% | ⚠ Explotación activa | 7 may 2014 | The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory… |
| CVE-2022-1388 | Crítica (9.8) | 100% | ⚠ Explotación activa | 5 may 2022 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass… |
| CVE-2014-7169 | Crítica (9.8) | 100% | ⚠ Explotación activa | 25 sept 2014 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown… |
| CVE-2014-6271 | Crítica (9.8) | 100% | ⚠ Explotación activa | 24 sept 2014 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by… |
| CVE-2021-22991 | Crítica (9.8) | 61% | ⚠ Explotación activa | 31 mar 2021 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the… |
| CVE-2021-22986 | Crítica (9.8) | 100% | ⚠ Explotación activa | 31 mar 2021 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST… |
| CVE-2020-5902 | Crítica (9.8) | 100% | ⚠ Explotación activa | 1 jul 2020 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-63020 | Baja (2.3) | 0.23% | — | 2 sept 2026 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and… |
| CVE-2026-42937 | Alta (7.1) | 0.28% | — | 13 may 2026 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent… |
| CVE-2026-42930 | Alta (8.5) | 0.58% | — | 13 may 2026 | When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have reached End of… |
| CVE-2026-42924 | Alta (8.5) | 0.41% | — | 13 may 2026 | An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached… |
| CVE-2026-42920 | Alta (8.7) | 0.46% | — | 13 may 2026 | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have… |
| CVE-2026-42919 | Alta (7.1) | 0.42% | — | 13 may 2026 | A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note:… |
| CVE-2026-42781 | Alta (7.1) | 0.27% | — | 13 may 2026 | When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note:… |
| CVE-2026-42409 | Alta (8.7) | 0.46% | — | 13 may 2026 | When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to… |
| CVE-2026-42408 | Media (6.7) | 0.11% | — | 13 may 2026 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which… |
| CVE-2026-42406 | Alta (8.5) | 0.25% | — | 13 may 2026 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.… |
| CVE-2026-42063 | Media (6.9) | 0.40% | — | 13 may 2026 | A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical… |
| CVE-2026-42058 | Media (5.3) | 0.26% | — | 13 may 2026 | An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names. Note: Software versions which have reached End of Technical Support (EoTS) are… |
| CVE-2026-41959 | Alta (7.1) | 0.28% | — | 13 may 2026 | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view… |
| CVE-2026-41957 | Alta (8.7) | 0.87% | — | 13 may 2026 | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not… |
| CVE-2026-41956 | Alta (8.7) | 0.46% | — | 13 may 2026 | When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical… |
| CVE-2026-41954 | Media (6.9) | 0.40% | — | 13 may 2026 | Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view… |
| CVE-2026-41953 | Alta (8.5) | 0.41% | — | 13 may 2026 | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation. Note: Software… |
| CVE-2026-41225 | Alta (8.6) | 0.46% | — | 13 may 2026 | A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions… |
| CVE-2026-41219 | Alta (7.1) | 0.38% | — | 13 may 2026 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. Note: Software versions which have reached End of… |
| CVE-2026-41218 | Alta (8.7) | 0.46% | — | 13 may 2026 | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic… |
| CVE-2026-41217 | Alta (8.3) | 0.16% | — | 13 may 2026 | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher… |
| CVE-2026-40703 | Media (5.3) | 0.14% | — | 13 may 2026 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40699 | Alta (7.1) | 0.38% | — | 13 may 2026 | A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have… |
| CVE-2026-40698 | Alta (8.5) | 0.41% | — | 13 may 2026 | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS… |
| CVE-2026-40631 | Alta (8.5) | 0.41% | — | 13 may 2026 | An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of… |
| CVE-2026-40629 | Alta (8.7) | 0.46% | — | 13 may 2026 | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support… |
| CVE-2026-40618 | Alta (8.7) | 0.46% | — | 13 may 2026 | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to… |
| CVE-2026-40462 | Alta (7.1) | 0.34% | — | 13 may 2026 | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which… |
| CVE-2026-40435 | Media (6.9) | 0.31% | — | 13 may 2026 | When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not… |
| CVE-2026-40423 | Alta (8.7) | 0.46% | — | 13 may 2026 | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are… |
Otros productos de F5
Big-ip Access Policy Manager · 630Big-ip Application Security Manager · 581Big-ip Local Traffic Manager · 541Big-ip Policy Enforcement Manager · 533Big-ip Link Controller · 525Big-ip Application Acceleration Manager · 524Big-ip Analytics · 511Big-ip Global Traffic Manager · 490Big-ip Domain Name System · 469Big-ip Fraud Protection Service · 405Big-ip Webaccelerator · 297Big-ip Edge Gateway · 293