UpHeron
All vulnerabilities

Servers and applications

CVE-2014-2927

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

Severity
High 9.3
Published
15 Oct 2014
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
7.9% in the next 30 daysHigher than 94% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper authentication (CWE-287)
Attack
Over the network · No login needed
Attacker can
Read data · Change data · Take it down
CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Sources
NVD

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • Version 11.6.0
  • Version 11.5.1
  • Version 11.5.0
  • Version 11.4.1
All 16 release lines
  • Version 10.1.0
  • Version 10.2.0
  • Version 10.2.1
  • Version 10.2.2
  • Version 10.2.3
  • Version 10.2.4
  • Version 11.0.0
  • Version 11.1.0
  • Version 11.2.0
  • Version 11.2.1
  • Version 11.3.0
  • Version 11.4.0
  • Version 11.4.1
  • Version 11.5.0
  • Version 11.5.1
  • Version 11.6.0
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager
  • Version 11.6.0
  • Version 11.5.1
  • Version 11.5.0
  • Version 11.4.1
All 18 release lines
  • Version 10.0.0
  • Version 10.0.1
  • Version 10.1.0
  • Version 10.2.0
  • Version 10.2.1
  • Version 10.2.2
  • Version 10.2.3
  • Version 10.2.4
  • Version 11.0.0
  • Version 11.1.0
  • Version 11.2.0
  • Version 11.2.1
  • Version 11.3.0
  • Version 11.4.0
  • Version 11.4.1
  • Version 11.5.0
  • Version 11.5.1
  • Version 11.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-2927
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-2927