F5 Big-Ip Advanced Firewall Manager vulnerabilities

546 known vulnerabilities affecting f5/big-ip_advanced_firewall_manager.

Total CVEs

546

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL40HIGH303MEDIUM199LOW4

Vulnerabilities

SortPage 23 of 28

CVE-2019-19151P4MEDIUMCVSS 5.5≥ 11.5.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-23

CVE-2019-19151 [MEDIUM] CWE-269 CVE-2019-19151: On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5 On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallo

nvd

CVE-2025-54500P4MEDIUMCVSS 5.3≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.6.1+2 more2025-08-13

CVE-2025-54500 [MEDIUM] CWE-770 CVE-2025-54500: An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control fr An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-42063P4MEDIUMCVSS 4.9≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-42063 [MEDIUM] CWE-552 CVE-2026-42063: A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administra A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2018-15314P4MEDIUMCVSS 6.1≥ 12.1.0, ≤ 12.1.3.6≥ 13.0.0, ≤ 13.1.1.12018-10-19

CVE-2018-15314 [MEDIUM] CWE-79 CVE-2018-15314: On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vuln On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.

nvd

CVE-2018-15313P4MEDIUMCVSS 6.1≥ 12.1.0, ≤ 12.1.3.6≥ 13.0.0, ≤ 13.1.1.12018-10-19

CVE-2018-15313 [MEDIUM] CWE-79 CVE-2018-15313: On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vuln On F5 BIG-IP AFM 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a Reflected Cross Site Scripting vulnerability in undisclosed TMUI page.

nvd

CVE-2026-42781P4MEDIUMCVSS 6.5v21.0.0≥ 17.1.0, ≤ 17.1.3+1 more2026-05-13

CVE-2026-42781 [MEDIUM] CWE-835 CVE-2026-42781: When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethe When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2021-23027P4MEDIUMCVSS 6.1≥ 14.1.0, ≤ 14.1.4≥ 15.1.0, ≤ 15.1.3+1 more2021-09-14

CVE-2021-23027 [MEDIUM] CWE-79 CVE-2021-23027: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based c On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Te

nvd

CVE-2017-6141P4MEDIUMCVSS 5.9v12.1.0v12.1.1+1 more2017-10-20

CVE-2017-6141 [MEDIUM] CWE-20 CVE-2017-6141: In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certa In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default.

nvd

CVE-2019-6608P4MEDIUMCVSS 5.9≥ 11.2.1, ≤ 11.6.3≥ 12.1.0, ≤ 12.1.3+2 more2019-03-28

CVE-2019-6608 [MEDIUM] CWE-401 CVE-2019-6608: On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditio On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when processing authorized SNMP requests.

nvd

CVE-2019-6594P4MEDIUMCVSS 5.9≥ 11.5.1, ≤ 11.6.3.2≥ 12.1.3.4, ≤ 12.1.3.7+3 more2019-02-26

CVE-2019-6594 [MEDIUM] CWE-835 CVE-2019-6594: On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path T On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.

nvd

CVE-2014-5209P4MEDIUMCVSS 5.3≥ 11.4.0, ≤ 11.6.4≥ 12.0.0, ≤ 12.1.4+3 more2020-01-08

CVE-2014-5209 [MEDIUM] CWE-200 CVE-2014-5209: An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.

nvd

CVE-2019-6640P4MEDIUMCVSS 5.3≥ 11.5.1, < 11.5.9≥ 11.6.1, < 11.6.4+4 more2019-07-03

CVE-2019-6640 [MEDIUM] CWE-319 CVE-2019-6640: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11. On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2.

nvd

CVE-2019-6655P4MEDIUMCVSS 5.3≥ 11.5.2, ≤ 11.5.9≥ 11.6.1, ≤ 11.6.4+2 more2019-09-25

CVE-2019-6655 [MEDIUM] CVE-2019-6655: On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms whe On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.

nvd

CVE-2015-4638P4MEDIUMCVSS 5.0v11.3.0v11.4.0+5 more2015-09-18

CVE-2015-4638 [MEDIUM] CWE-20 CVE-2015-4638: The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 through 11.3.0, and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restar

nvd

CVE-2020-5890P4MEDIUMCVSS 5.5≥ 12.1.0, ≤ 12.1.5.1≥ 13.1.0, ≤ 13.1.3.3+2 more2020-04-30

CVE-2020-5890 [MEDIUM] CWE-200 CVE-2020-5890: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1. On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace.

nvd

CVE-2018-15333P4MEDIUMCVSS 5.5≥ 11.2.1, ≤ 11.6.3≥ 12.1.0, ≤ 12.1.4+2 more2018-12-28

CVE-2018-15333 [MEDIUM] CWE-434 CVE-2018-15333: On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with On versions 11.2.1. and greater, unrestricted Snapshot File Access allows BIG-IP system's user with any role, including Guest Role, to have access and download previously generated and available snapshot files on the BIG-IP configuration utility such as QKView and TCPDumps.

nvd

CVE-2019-6632P4MEDIUMCVSS 5.5≥ 12.1.0, < 12.1.4.1≥ 13.0.0, < 13.1.1.5+2 more2019-07-03

CVE-2019-6632 [MEDIUM] CWE-330 CVE-2019-6632: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circum On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

nvd

CVE-2022-28707P4MEDIUMCVSS 5.4v14.1.0v14.1.2+12 more2022-05-05

CVE-2022-28707 [MEDIUM] CWE-79 CVE-2022-28707: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versio On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility (also referred to as the BIG-IP TMUI) that allows an attacker to execute JavaScript in the context of the currentl

nvd

CVE-2019-6613P4MEDIUMCVSS 5.3≥ 11.5.2, < 11.5.9≥ 11.6.1, < 11.6.4+2 more2019-05-03

CVE-2019-6613 [MEDIUM] CWE-319 CVE-2019-6613: On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensit On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.

nvd

CVE-2020-5940P4MEDIUMCVSS 5.4≥ 14.1.0, < 14.1.2.4≥ 15.1.0, < 15.1.1+1 more2020-11-05

CVE-2020-5940 [MEDIUM] CWE-79 CVE-2020-5940: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XS In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

nvd

← Previous23 / 28Next →