CVE-2021-23025 — OS Command Injection in F5 Big-ip Access Policy Manager

CWE-78 — OS Command Injection4 documents4 sources
Severity
8.8HIGHNVD
EPSS
1.1%
top 21.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Advanced WEB Application Firewall+11 more
Timeline
PublishedSep 14
Latest updateMay 24

Description

On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages15 packages

▶NVDf5/big-ip_analytics13.1.0 — 13.1.3.5+4
▶NVDf5/big-ip_link_controller13.1.0 — 13.1.3.5+4
▶NVDf5/big-ip_ssl_orchestrator13.1.0 — 13.1.3.5+4
▶NVDf5/big-ip_domain_name_system13.1.0 — 13.1.3.5+4
▶NVDf5/big-ip_ddos_hybrid_defender13.1.0 — 13.1.3.5+4

🔴Vulnerability Details

2
GHSA
GHSA-84pv-q4h7-244g: On version 15↗2022-05-24
▶
CVEList
CVE-2021-23025: On version 15↗2021-09-14
▶

📋Vendor Advisories

1
F5
CVE-2021-23025: On version 15↗2021-09-14
▶
CVE-2021-23025 — OS Command Injection in F5 | cvebase