F5 Big-Ip Application Acceleration Manager vulnerabilities

518 known vulnerabilities affecting f5/big-ip_application_acceleration_manager.

Total CVEs

518

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL37HIGH290MEDIUM187LOW4

Vulnerabilities

SortPage 17 of 26

CVE-2017-6128P3HIGHCVSS 7.5v11.4.0v11.4.1+7 more2017-05-01

CVE-2017-6128 [HIGH] CVE-2017-6128: An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 B An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.

nvd

CVE-2020-5875P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.3≥ 15.0.0, ≤ 15.0.12020-04-30

CVE-2020-5875 [HIGH] CVE-2020-5875: On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microk On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.

nvd

CVE-2020-5862P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2≥ 15.0.0, ≤ 15.0.1.1+1 more2020-03-27

CVE-2020-5862 [HIGH] CWE-20 CVE-2020-5862: On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may c On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.

nvd

CVE-2020-5871P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.32020-04-30

CVE-2020-5871 [HIGH] CVE-2020-5871: On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to B On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.

nvd

CVE-2020-5878P3HIGHCVSS 7.5≥ 14.1.0, ≤ 14.1.2.3≥ 15.0.0, ≤ 15.0.1.1+1 more2020-04-30

CVE-2020-5878 [HIGH] CVE-2020-5878: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (T On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic.

nvd

CVE-2020-5857P3HIGHCVSS 7.5≥ 11.5.2, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2020-03-27

CVE-2020-5857 [HIGH] CVE-2020-5857: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undis On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.

nvd

CVE-2020-5856P3HIGHCVSS 7.5≥ 14.1.0, < 14.1.2.3≥ 15.0.0, < 15.1.02020-02-06

CVE-2020-5856 [HIGH] CVE-2020-5856: On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using t On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart.

nvd

CVE-2019-6671P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.3.1≥ 14.0.0, ≤ 14.0.1+2 more2019-11-27

CVE-2019-6671 [HIGH] CWE-401 CVE-2019-6671: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.

nvd

CVE-2019-6669P3HIGHCVSS 7.5≥ 11.5.1, ≤ 11.6.5.1≥ 12.1.0, ≤ 12.1.5+4 more2019-11-27

CVE-2019-6669 [HIGH] CVE-2019-6669: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11 On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.

nvd

CVE-2019-6614P3MEDIUMCVSS 6.5≥ 12.1.0, < 12.1.4.1≥ 13.0.0, < 13.1.1.5+1 more2019-05-03

CVE-2019-6614 [MEDIUM] CVE-2019-6614: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbi On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.

nvd

CVE-2022-23023P3MEDIUMCVSS 6.5≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, ≤ 13.1.4+3 more2022-01-25

CVE-2022-23023 [MEDIUM] CWE-400 CVE-2022-23023: On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all vers On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (E

nvd

CVE-2024-21782P3MEDIUMCVSS 6.7≥ 15.1.0, < 15.1.9≥ 16.1.0, < 16.1.4+1 more2024-02-14

CVE-2024-21782 [MEDIUM] CVE-2024-21782: BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Techni

nvd

CVE-2022-34851P3MEDIUMCVSS 6.5≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, < 14.1.5.1+3 more2022-08-04

CVE-2022-34851 [MEDIUM] CWE-20 CVE-2022-34851: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x be In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed requests. Note: Software versions which have reached End of Te

nvd

CVE-2020-5938P3MEDIUMCVSS 6.5≥ 11.6.1, ≤ 11.6.5.2≥ 12.1.0, ≤ 12.1.5.2+1 more2020-10-29

CVE-2020-5938 [MEDIUM] CWE-326 CVE-2020-5938: On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.

nvd

CVE-2026-35062P3MEDIUMCVSS 6.5≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-35062 [MEDIUM] CWE-266 CVE-2026-35062: An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Sof An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2015-5058P4HIGHCVSS 7.8v11.5.1v11.5.3+1 more2015-08-24

CVE-2015-5058 [HIGH] CWE-399 CVE-2015-5058: Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Li Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large

nvd

CVE-2024-31156P3HIGHCVSS 8.0≥ 15.1.0, < 15.1.10.4≥ 16.1.0, < 16.1.4.3+1 more2024-05-08

CVE-2024-31156 [HIGH] CWE-79 CVE-2024-31156: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Confi A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2018-5510P4HIGHCVSS 7.5v11.5.4v11.5.52018-04-13

CVE-2018-5510 [HIGH] CWE-20 CVE-2018-5510: On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 virtual servers.

nvd

CVE-2020-5859P4HIGHCVSS 7.5≥ 15.0.0, ≤ 15.0.1.12020-03-27

CVE-2020-5859 [HIGH] CVE-2020-5859: On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file. On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.

nvd

CVE-2019-6666P3HIGHCVSS 7.5≥ 13.1.0, ≤ 13.1.1.4≥ 14.0.0, ≤ 14.0.0.4+2 more2019-11-27

CVE-2019-6666 [HIGH] CVE-2019-6666: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value.

nvd

← Previous17 / 26Next →