F5 Big-Ip Advanced Firewall Manager vulnerabilities

546 known vulnerabilities affecting f5/big-ip_advanced_firewall_manager.

Total CVEs

546

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL40HIGH303MEDIUM199LOW4

Vulnerabilities

SortPage 16 of 28

CVE-2019-6677P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, < 13.1.3.2+3 more2019-12-23

CVE-2019-6677 [HIGH] CVE-2019-6677: On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custom TCP congestion control settings in a TCP profile, TMM stops processing traffic when processed by an iRule.

nvd

CVE-2020-5949P3HIGHCVSS 7.5≥ 13.1.0, < 13.1.3.5≥ 14.0.0, < 14.1.02020-12-11

CVE-2020-5949 [HIGH] CVE-2020-5949: On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual serv On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.

nvd

CVE-2021-22977P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3.1≥ 16.0.0, < 16.0.1.12021-02-12

CVE-2021-22977 [HIGH] CVE-2021-22977: On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2019-6667P3HIGHCVSS 7.5≥ 11.5.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.4.1+4 more2019-11-27

CVE-2019-6667 [HIGH] CWE-400 CVE-2019-6667: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11. On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financial Information eXchange) profile applied.

nvd

CVE-2019-6673P3HIGHCVSS 7.5≥ 14.0.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.0.12019-11-27

CVE-2019-6673 [HIGH] CVE-2019-6673: On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).

nvd

CVE-2020-27714P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.3≥ 14.1.0, < 14.1.3.1+1 more2020-12-24

CVE-2020-27714 [HIGH] CVE-2020-27714: On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspe On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic.

nvd

CVE-2021-22975P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.3.1≥ 15.1.0, < 15.1.2.1+1 more2021-02-12

CVE-2021-22975 [HIGH] CVE-2021-22975: On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

nvd

CVE-2024-25560P3HIGHCVSS 7.5≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.4+1 more2024-05-08

CVE-2024-25560 [HIGH] CWE-476 CVE-2024-25560: When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Manageme When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2025-21091P3HIGHCVSS 7.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, < 16.1.6+1 more2025-02-05

CVE-2025-21091 [HIGH] CWE-401 CVE-2025-21091: When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2017-6156P3MEDIUMCVSS 6.4≥ 11.5.1, ≤ 11.5.5≥ 12.1.0, ≤ 12.1.1+2 more2018-04-13

CVE-2017-6156 [MEDIUM] CVE-2017-6156: When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations. The attacker must possess the necessary credentials to negotiate the phase 1 of the IPSec exchange to exploit t

nvd

CVE-2019-6636P3HIGHCVSS 8.4≥ 12.0.0, < 12.1.4.1≥ 13.0.0, < 13.1.1.5+2 more2019-07-03

CVE-2019-6636 [HIGH] CWE-79 CVE-2019-6636: On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11 On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can perform this attack are resource administrator and admin

nvd

CVE-2018-5512P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.0.52018-05-02

CVE-2018-5512 [HIGH] CVE-2018-5512: On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload (LRO) and SYN cookies are enabled (default settings), undisclosed traffic patterns may cause TMM to restart.

nvd

CVE-2019-9075P3HIGHCVSS 7.8v14.1.0v15.0.02019-02-24

CVE-2019-9075 [HIGH] CWE-787 CVE-2019-9075: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.

nvd

CVE-2017-6151P3HIGHCVSS 7.5v13.0.02017-12-21

CVE-2017-6151 [HIGH] CVE-2017-6151: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAc In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers which make use of the "HTTP/2 profile" may result in a disruption of service to TMM.

nvd

CVE-2017-6135P3HIGHCVSS 7.5v13.0.02017-12-21

CVE-2017-6135 [HIGH] CWE-772 CVE-2017-6135: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions.

nvd

CVE-2019-8331P3MEDIUMCVSS 6.1≥ 12.1.0, < 12.1.5.1≥ 13.0.0, < 13.1.3.4+2 more2019-02-20

CVE-2019-8331 [MEDIUM] CWE-79 CVE-2019-8331: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-tem In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

nvd

CVE-2018-15318P3HIGHCVSS 7.5≥ 12.1.3.4, ≤ 12.1.3.6≥ 13.0.0, ≤ 13.1.1.1+1 more2018-10-31

CVE-2018-15318 [HIGH] CWE-20 CVE-2018-15318: In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this condition.

nvd

CVE-2016-9253P3HIGHCVSS 7.5v12.1.0v12.1.1+1 more2017-05-09

CVE-2016-9253 [HIGH] CWE-20 CVE-2016-9253: In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of se In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.

nvd

CVE-2018-15320P3HIGHCVSS 7.5≥ 13.0.0, ≤ 13.1.1.1≥ 14.0.0, ≤ 14.0.0.22018-10-31

CVE-2018-15320 [HIGH] CVE-2018-15320: On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of ser On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than "allow-all".

nvd

CVE-2020-5872P3HIGHCVSS 7.5≥ 12.1.0, ≤ 12.1.4.1≥ 13.1.0, ≤ 13.1.3.1+2 more2020-04-30

CVE-2020-5872 [HIGH] CVE-2020-5872: On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event.

nvd

← Previous16 / 28Next →