cbcvebase.
CVE-2019-6642
published 2019-07-01

CVE-2019-6642: In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise…

PriorityP354high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.82%
76.3th percentile
In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Affected

85 ranges· showing 25
VendorProductVersion rangeFixed in
f5big-ip_aam——
f5big-ip_access_policy_manager——
f5big-ip_access_policy_manager11.5.2 – 11.6.4—
f5big-ip_access_policy_manager12.1.0 – 12.1.4.2—
f5big-ip_access_policy_manager13.0.0 – 13.1.1.5—
f5big-ip_access_policy_manager14.0.0 – 14.1.0.5—
f5big-ip_advanced_firewall_manager——
f5big-ip_advanced_firewall_manager11.5.2 – 11.6.4—
f5big-ip_advanced_firewall_manager12.1.0 – 12.1.4.2—
f5big-ip_advanced_firewall_manager13.0.0 – 13.1.1.5—
f5big-ip_advanced_firewall_manager14.0.0 – 14.1.0.5—
f5big-ip_afm——
f5big-ip_analytics——
f5big-ip_analytics——
f5big-ip_analytics11.5.2 – 11.6.4—
f5big-ip_analytics12.1.0 – 12.1.4.2—
f5big-ip_analytics13.0.0 – 13.1.1.5—
f5big-ip_analytics14.0.0 – 14.1.0.5—
f5big-ip_apm——
f5big-ip_application_acceleration_manager——
f5big-ip_application_acceleration_manager11.5.2 – 11.6.4—
f5big-ip_application_acceleration_manager12.1.0 – 12.1.4.2—
f5big-ip_application_acceleration_manager13.0.0 – 13.1.1.5—
f5big-ip_application_acceleration_manager14.0.0 – 14.1.0.5—
f5big-ip_application_security_manager——

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.