cbcvebase.
CVE-2023-41373
published 2023-10-10

CVE-2023-41373: A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP…

PriorityP267critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
2.38%
82.0th percentile
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

113 ranges· showing 25
VendorProductVersion rangeFixed in
f5big-ip>= 13.1.0 < **
f5big-ip>= 14.1.0 < 14.1.5.614.1.5.6
f5big-ip>= 15.1.0 < 15.1.10.215.1.10.2
f5big-ip>= 16.1.0 < 16.1.4.116.1.4.1
f5big-ip>= 17.1.0 < 17.1.0.317.1.0.3
f5big-ip_aam——
f5big-ip_access_policy_manager13.1.0 – 13.1.5—
f5big-ip_access_policy_manager>= 14.1.0 < 14.1.5.614.1.5.6
f5big-ip_access_policy_manager>= 15.1.0 < 15.1.10.215.1.10.2
f5big-ip_access_policy_manager>= 16.1.0 < 16.1.4.116.1.4.1
f5big-ip_access_policy_manager>= 17.1.0 < 17.1.0.317.1.0.3
f5big-ip_advanced_firewall_manager13.1.0 – 13.1.5—
f5big-ip_advanced_firewall_manager>= 14.1.0 < 14.1.5.614.1.5.6
f5big-ip_advanced_firewall_manager>= 15.1.0 < 15.1.10.215.1.10.2
f5big-ip_advanced_firewall_manager>= 16.1.0 < 16.1.4.116.1.4.1
f5big-ip_advanced_firewall_manager>= 17.1.0 < 17.1.0.317.1.0.3
f5big-ip_advanced_waf——
f5big-ip_advanced_web_application_firewall13.1.0 – 13.1.5—
f5big-ip_advanced_web_application_firewall>= 14.1.0 < 14.1.5.614.1.5.6
f5big-ip_advanced_web_application_firewall>= 15.1.0 < 15.1.10.215.1.10.2
f5big-ip_advanced_web_application_firewall>= 16.1.0 < 16.1.4.116.1.4.1
f5big-ip_advanced_web_application_firewall>= 17.1.0 < 17.1.0.317.1.0.3
f5big-ip_afm——
f5big-ip_analytics——
f5big-ip_analytics13.1.0 – 13.1.5—

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability class is directory traversal in the BIG-IP Configuration Utility, exploitable by an authenticated attacker to execute commands on the BIG-IP system ↗
  • →For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary — prioritize monitoring/alerting on Appliance mode deployments ↗
  • ·Affected BIG-IP versions span multiple major branches: 13.1.0–13.1.5, 14.1.0–14.1.5.6, 15.1.0–15.1.10.2, 16.1.0–16.1.4.1, and 17.1.0–17.1.0.3. Software versions that have reached End of Technical Support (EoTS) are not evaluated. ↗
  • ·The vulnerability affects a broad set of BIG-IP product modules (AAM, AFM, APM, ASM, AVR, Advanced WAF, Analytics, CGNAT, DHD, DNS, FPS, GTM, LTM, Link Controller, PEM, SSLO, WebAccelerator, WebSafe), meaning detection/patching scope is wide across the F5 product portfolio. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.