F5 Security Advisory: Critical BIG-IP CVE-2023-46747
F5 BIG-IP CVE-2023-46747 allows unauthenticated remote command execution when TMUI is exposed internally or externally. It affects specific versions from 13.x to 17.x; F5 provides a mitigation script and hotfixes. Run the script on each blade of VIPRION, vCMP, and VELOS systems; it could cause FIPS integrity check failures with a FIPS 140-2 Compliant Mode license.
Summary written with AI from this article, and checked against it.
At a glanceCVE-2023-46747
CVE-2023-46747 has a CVSS 3.1 base score of 9.8 (Critical) from NVD. No fixed version has been published yet.
| Severity | 9.8 Critical (CVSS 3.1, NVD) |
|---|---|
| Fixed in | No fixed version published yet |
| Affected | F5 big-ip access policy manager 13.1.0 – up to 13.1.5; 14.1.0 – up to 14.1.5; 15.1.0 – up to 15.1.10; 16.1.0 – up to 16.1.4; 17.1.0 – up to 17.1.1 |
| Exploited | Yes: in CISA's Known Exploited Vulnerabilities catalog since October 31, 2023 |
| EPSS | 97% chance of exploitation in the next 30 days (FIRST, October 27, 2026) |
| Public exploit | packetstormsecurity.com, secpod.com, packetstormsecurity.com, secpod.com · 8 GitHub repositories name it: proofs of concept, scanners, detections. Unverified: some are fake or malicious. |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-288 Authentication Bypass Using an Alternate Path or Channel · CWE-306 Missing Authentication for Critical Function |
| Ubuntu | Listed, no packages yet |
| Debian | Listed, no packages yet |
| Red Hat | Not tracked yet |
| Also in | F5 big-ip advanced firewall manager, F5 big-ip advanced web application firewall, F5 big-ip carrier-grade nat, F5 big-ip ddos hybrid defender, F5 big-ip ssl orchestrator, F5 big-ip domain name system |
Is there a public exploit for CVE-2023-46747?
Yes: CVE-2023-46747 is exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on October 31, 2023. NVD links 4 exploit references and 8 public GitHub repositories name it: proofs of concept, scanners and detections. None of it is verified: some such repositories are fake or carry malware, so read the code before running it, and only against systems you own. FIRST's EPSS puts the chance of exploitation in the next 30 days at 97%, higher than 99.8% of scored CVEs.
F5 has recently released an advisory informing the public about a critical vulnerability affecting its BIG-IP systems. Designated as CVE-2023-46747, this flaw has a high CVSS score of 9.8 out of 10 and could lead to unauthorized remote code execution. This article aims to provide a comprehensive analysis of the vulnerability, the affected products, and the steps you can take to mitigate the associated risks.
Detailed Explanation of the Vulnerability
According to F5's advisory, this vulnerability could allow an attacker, without requiring authentication, to gain network access to the BIG-IP system. This access could be gained either through the management port or self IP addresses, allowing the attacker to execute arbitrary commands on the system. Importantly, this vulnerability affects only the control plane of the BIG-IP system and does not impact the data plane. It is noteworthy that the vulnerability is exploitable only when the Traffic Management User Interface (TMUI) is exposed, whether internally or externally. However, if an attacker has already compromised a network, they could potentially exploit this flaw if TMUI is exposed internally.
Affected Products and Versions
The vulnerability impacts specific versions of the BIG-IP systems, namely:
- Version 17.x: Specifically, 17.1.0
- Version 16.x: Ranges from 16.1.0 to 16.1.4
- Version 15.x: Ranges from 15.1.0 to 15.1.10
- Version 14.x: Ranges from 14.1.0 to 14.1.5
- Version 13.x: Ranges from 13.1.0 to 13.1.5
Products that are not affected include BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud Services, F5OS, NGINX, and Traffix SDC. Unsupported versions that have reached their end-of-life have not been assessed for vulnerability and may or may not be at risk.
Recommended Mitigation Steps
F5 has issued specific guidelines to mitigate the vulnerability. These are:
Download and Install Mitigation Script
- Download the F5-supplied script onto the affected BIG-IP system.
- Rename the file from a .txt extension to a .sh extension. For example, rename it to 'mitigation.sh'.
- Log in to the command line of the impacted BIG-IP system with root user privileges.
- Use the chmod utility to make the script executable.
- Execute the script.
For FIPS 140-2 Compliant Systems
- Special caution is advised for systems with a FIPS 140-2 Compliant Mode license, as running the mitigation script could cause FIPS integrity check failures.
For VIPRION, vCMP, and VELOS Systems
- The script must be executed individually on each blade.
Update to Supported Versions
- F5 has released specific hotfixes for versions 13.x to 17.x of BIG-IP. Upgrading to these versions is strongly recommended.
Ending Notes
The security vulnerability in F5 BIG-IP systems, identified as CVE-2023-46747, poses a critical risk that allows for unauthorized remote code execution. It specifically affects versions 13.x to 17.x. F5 has provided mitigation scripts and hotfixes to address the vulnerability. Given the severity of this issue and the widespread usage of BIG-IP systems in critical infrastructures, it is of the utmost importance to apply the recommended fixes or mitigations as quickly as possible to prevent potential exploitation.
Source
- CVE recordCVE-2023-46747 in the National Vulnerability Database · nvd.nist.gov
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
