CVE-2017-6129 — Improper Input Validation in Networks INC Big-ip APM

CWE-20 — Improper Input Validation3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 34.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
F5 Networks INC Big-ip APMF5 Big-ip Access Policy ManagerF5 Big-ip APM
Timeline
PublishedDec 21
Latest updateMay 14

Description

In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5f5_networks_inc/big-ip_apm12.1.2, 13.0.0+1
▶NVDf5/big-ip_access_policy_manager12.1.2, 13.0.0+1

🔴Vulnerability Details

1
GHSA
GHSA-xg29-xvm5-p526: In F5 BIG-IP APM software version 13↗2022-05-14
▶

📋Vendor Advisories

1
F5
CVE-2017-6129: In F5 BIG-IP APM software version 13↗2017-12-21
▶