CVE-2019-6609

CWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.5%
top 35.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Analytics+12 more
Timeline
PublishedApr 15
Latest updateMay 13

Description

Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additional…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages15 packages

▶NVDf5/big-ip_edge_gateway12.1.2 — 12.1.4.1+3
▶NVDf5/big-ip_link_controller12.1.2 — 12.1.4.1+3
▶NVDf5/big-ip_analytics12.1.2 — 12.1.4.1+3
▶NVDf5/big-ip_webaccelerator12.1.2 — 12.1.4.1+2

🔴Vulnerability Details

2
GHSA
GHSA-9m58-qhcx-hmcm: Platform dependent weakness↗2022-05-13
▶
CVEList
CVE-2019-6609: Platform dependent weakness↗2019-04-15
▶

📋Vendor Advisories

1
F5
CVE-2019-6609: Platform dependent weakness↗2019-04-15
▶
CVE-2019-6609 (CRITICAL CVSS 9.8) | Platform dependent weakness | cvebase.io