If F5 products are used in networks, admins should update the software for security reasons. If this does not happen, attackers could gain unauthorized access to devices and, among other things, paralyze them. Admins can find information about the security patches in the warning messages linked below this message.
Dangerous gaps
A vulnerability is considered particularly dangerous (CVE-2023-28656 “hoch“) in NGINX Management Suite. For an attack to be successful, however, an attacker must already be logged in. If this is the case, he could manipulate configuration settings.
With various BIG-IP appliances, an attacker could target the Traffic Management Microkernel (TMM) (CVE-2023-29163 “hoch“) to paralyze the service. No authentication should be required for this. Attackers could start with the BIG-IP Edge Client for Windows and macOS due to an insufficient certificate check and thus latch onto connections as a man-in-the-middle.
Even more vulnerabilities
More with the threat level “middle” classified vulnerabilities threaten, among other things, BIG-IQ REST and BIG-IP Configuration utility. If attacks are successful, attackers could upload their own files or view information that is actually isolated. In both cases, authentication is required.
List sorted by threat level in descending order:
(of the)
