Lucene search

F5CVE-2017-6131

HistoryMay 23, 2017 - 3:29 p.m.

CVE-2017-6131

2017-05-2315:29:00

CWE-798

web.nvd.nist.gov

f5 big-ip

vulnerability

remote login

default password

administrative account

nvd

cve-2017-6131

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH.

Affected configurations

Nvd

Node

f5big-ip_local_traffic_managerMatch12.0.0

f5big-ip_local_traffic_managerMatch12.1.0

f5big-ip_local_traffic_managerMatch12.1.1

f5big-ip_local_traffic_managerMatch12.1.2

f5big-ip_local_traffic_managerMatch13.0.0

Node

f5big-ip_application_acceleration_managerMatch12.0.0

f5big-ip_application_acceleration_managerMatch12.1.0

f5big-ip_application_acceleration_managerMatch12.1.1

f5big-ip_application_acceleration_managerMatch12.1.2

f5big-ip_application_acceleration_managerMatch13.0.0

Node

f5big-ip_advanced_firewall_managerMatch12.0.0

f5big-ip_advanced_firewall_managerMatch12.1.0

f5big-ip_advanced_firewall_managerMatch12.1.1

f5big-ip_advanced_firewall_managerMatch12.1.2

f5big-ip_advanced_firewall_managerMatch13.0.0

Node

f5big-ip_access_policy_managerMatch12.0.0

f5big-ip_access_policy_managerMatch12.1.0

f5big-ip_access_policy_managerMatch12.1.1

f5big-ip_access_policy_managerMatch12.1.2

f5big-ip_access_policy_managerMatch13.0.0

Node

f5big-ip_application_security_managerMatch12.0.0

f5big-ip_application_security_managerMatch12.1.0

f5big-ip_application_security_managerMatch12.1.1

f5big-ip_application_security_managerMatch12.1.2

f5big-ip_application_security_managerMatch13.0.0

Node

f5big-ip_domain_name_systemMatch12.0.0

f5big-ip_domain_name_systemMatch12.1.0

f5big-ip_domain_name_systemMatch12.1.1

f5big-ip_domain_name_systemMatch12.1.2

f5big-ip_domain_name_systemMatch13.0.0

Node

f5big-ip_link_controllerMatch12.0.0

f5big-ip_link_controllerMatch12.1.0

f5big-ip_link_controllerMatch12.1.1

f5big-ip_link_controllerMatch12.1.2

f5big-ip_link_controllerMatch13.0.0

Node

f5big-ip_policy_enforcement_managerMatch12.0.0

f5big-ip_policy_enforcement_managerMatch12.1.0

f5big-ip_policy_enforcement_managerMatch12.1.1

f5big-ip_policy_enforcement_managerMatch12.1.2

f5big-ip_policy_enforcement_managerMatch13.0.0

Node

f5big-ip_websafeMatch12.0.0

f5big-ip_websafeMatch12.1.0

f5big-ip_websafeMatch12.1.1

f5big-ip_websafeMatch12.1.2

f5big-ip_websafeMatch13.0.0

VendorProductVersionCPE
f5big-ip_local_traffic_manager12.0.0cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*
f5big-ip_local_traffic_manager12.1.0cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*
f5big-ip_local_traffic_manager12.1.1cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*
f5big-ip_local_traffic_manager12.1.2cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*
f5big-ip_local_traffic_manager13.0.0cpe:2.3:a:f5:big-ip_local_traffic_manager:13.0.0:*:*:*:*:*:*:*
f5big-ip_application_acceleration_manager12.0.0cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*
f5big-ip_application_acceleration_manager12.1.0cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*
f5big-ip_application_acceleration_manager12.1.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*
f5big-ip_application_acceleration_manager12.1.2cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*
f5big-ip_application_acceleration_manager13.0.0cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
f5	big-ip_local_traffic_manager	12.0.0	cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:::::::*
f5	big-ip_local_traffic_manager	12.1.0	cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:::::::*
f5	big-ip_local_traffic_manager	12.1.1	cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:::::::*
f5	big-ip_local_traffic_manager	12.1.2	cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:::::::*
f5	big-ip_local_traffic_manager	13.0.0	cpe:2.3:a:f5:big-ip_local_traffic_manager:13.0.0:::::::*
f5	big-ip_application_acceleration_manager	12.0.0	cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:::::::*
f5	big-ip_application_acceleration_manager	12.1.0	cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:::::::*
f5	big-ip_application_acceleration_manager	12.1.1	cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:::::::*
f5	big-ip_application_acceleration_manager	12.1.2	cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:::::::*
f5	big-ip_application_acceleration_manager	13.0.0	cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:::::::*

Rows per page:

1-10 of 451

CNA Affected

[
  {
    "product": "BIG-IP Azure cloud instance",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "12.0.0 to 12.1.2"
      },
      {
        "status": "affected",
        "version": "13.0.0"
      }
    ]
  }
]

References

www.securitytracker.com/id/1038569

support.f5.com/csp/article/K61757346

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

Related for CVE-2017-6131