CVE-2022-23028 — Incorrect Calculation in F5 Big-ip Advanced Firewall Manager

CWE-682 — Incorrect Calculation4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.6%
top 30.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
F5 Big-ip Advanced Firewall ManagerF5 Big-ip AFM
Timeline
PublishedJan 25
Latest updateJan 26

Description

On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDf5/big-ip_advanced_firewall_manager13.1.0 — 13.1.4+2
▶CVEListV5f5/big-ip_afm16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x

🔴Vulnerability Details

2
GHSA
GHSA-j64f-pwh4-gjqv: On BIG-IP AFM version 16↗2022-01-26
▶
CVEList
CVE-2022-23028: On BIG-IP AFM version 16↗2022-01-25
▶

📋Vendor Advisories

1
F5
CVE-2022-23028: On BIG-IP AFM version 16↗2022-01-25
▶
CVE-2022-23028 — Incorrect Calculation in F5 | cvebase