UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 31 Oct 2023.

Severity
High 8.8
Published
26 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • From 13.1.0 up to 13.1.5
  • From 14.1.0 up to 14.1.5
  • From 15.1.0 up to 15.1.10
  • From 16.1.0 up to 16.1.4
  • From 17.1.0 up to 17.1.1
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager
  • From 13.1.0 up to 13.1.5
  • From 14.1.0 up to 14.1.5
  • From 15.1.0 up to 15.1.10
  • From 16.1.0 up to 16.1.4
  • From 17.1.0 up to 17.1.1

Known exploited

CISA name
F5 BIG-IP Configuration Utility SQL Injection Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
21 Nov 2023
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46748
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46748