UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 31 Oct 2023.

Severity
Critical 9.8
Published
26 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • From 13.1.0 up to 13.1.5
  • From 14.1.0 up to 14.1.5
  • From 15.1.0 up to 15.1.10
  • From 16.1.0 up to 16.1.4
  • From 17.1.0 up to 17.1.1
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager
  • From 13.1.0 up to 13.1.5
  • From 14.1.0 up to 14.1.5
  • From 15.1.0 up to 15.1.10
  • From 16.1.0 up to 16.1.4
  • From 17.1.0 up to 17.1.1

Known exploited

CISA name
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
21 Nov 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46747
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46747