Servers and applications
CVE-2016-7468
An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to non-default setting "enabled". The default value for the tm.tcpprogressive db variable is "negotiate". An…
- Severity
- Medium 5.9
- Published
- 23 Mar 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.8% in the next 30 daysHigher than 78% of CVEs. EPSS by FIRST, 11 Nov 2026
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H- Sources
- NVD
Description
An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to non-default setting "enabled". The default value for the tm.tcpprogressive db variable is "negotiate". An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
Affected software
| Software | Affected versions |
|---|---|
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager |
All 7 release lines
|
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager |
All 7 release lines
|