UpHeron
All vulnerabilities

Servers and applications

CVE-2014-2928

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and…

Severity
High 7.1
Published
12 May 2014
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
40% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · Only under certain conditions · Needs a login
Attacker can
Read data · Change data · Take it down
CVSS vector
AV:N/AC:H/Au:S/C:C/I:C/A:C
Sources
NVD

Description

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.

From NVD.

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • Version 10.1.0
  • Version 10.2.0
  • Version 10.2.1
  • Version 10.2.2
  • Version 11.0.0
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager
  • Version 11.0.0
  • Version 10.2.2
  • Version 10.2.1
  • Version 10.2.0
All 7 release lines
  • Version 10.0.0
  • Version 10.0.1
  • Version 10.1.0
  • Version 10.2.0
  • Version 10.2.1
  • Version 10.2.2
  • Version 11.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-2928
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-2928