F5 Big-Ip Local Traffic Manager vulnerabilities

535 known vulnerabilities affecting f5/big-ip_local_traffic_manager.

Total CVEs

535

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL42HIGH299MEDIUM189LOW5

Vulnerabilities

SortPage 22 of 27

CVE-2022-23029P4MEDIUMCVSS 5.3≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6+3 more2022-01-25

CVE-2022-23029 [MEDIUM] CWE-367 CVE-2022-23029: On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versio On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not eva

nvd

CVE-2016-5024P4MEDIUMCVSS 5.9v11.6.1v12.1.0+1 more2017-01-03

CVE-2016-5024 [MEDIUM] CWE-20 CVE-2016-5024: Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configu Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS messages via an iRule, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.

nvd

CVE-2018-5522P4MEDIUMCVSS 5.9≥ 11.5.0, ≤ 11.5.5≥ 11.6.0, ≤ 11.6.3+3 more2018-06-01

CVE-2018-5522 [MEDIUM] CWE-20 CVE-2018-5522: On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAME On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash.

nvd

CVE-2017-6147P4MEDIUMCVSS 5.9v12.1.2v13.0.02017-09-18

CVE-2017-6147 [MEDIUM] CVE-2017-6147: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 a In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server.

nvd

CVE-2020-5915P4MEDIUMCVSS 6.1≥ 11.6.1, < 11.6.5.2≥ 12.1.0, < 12.1.5.2+4 more2020-08-26

CVE-2020-5915 [MEDIUM] CWE-79 CVE-2020-5915: In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5 In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.

nvd

CVE-2017-6137P4MEDIUMCVSS 5.9v11.6.1v12.0.0+3 more2017-05-09

CVE-2017-6137 [MEDIUM] CVE-2017-6137: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disruption of service to the Traffic Management Microkernel (TMM) on spec

nvd

CVE-2018-15323P4MEDIUMCVSS 5.9≥ 13.0.0, ≤ 13.1.1.1≥ 14.0.0, ≤ 14.0.0.22018-10-31

CVE-2018-15323 [MEDIUM] CWE-20 CVE-2018-15323: On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic thro On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action.

nvd

CVE-2021-22979P4MEDIUMCVSS 6.1≥ 12.1.0, ≤ 12.1.5≥ 13.1.0, < 13.1.3.5+3 more2021-02-12

CVE-2021-22979 [MEDIUM] CWE-79 CVE-2021-22979: On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the co

nvd

CVE-2020-5935P4MEDIUMCVSS 5.9≥ 13.1.0, < 13.1.3.4≥ 14.1.0, < 14.1.2.4+1 more2020-10-29

CVE-2020-5935 [MEDIUM] CVE-2020-5935: On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0- On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file.

nvd

CVE-2025-59269P4MEDIUMCVSS 6.1≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.6.1+2 more2025-10-15

CVE-2025-59269 [MEDIUM] CWE-79 CVE-2025-59269: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Config A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2024-23976P4MEDIUMCVSS 6.0≥ 15.1.0, < 15.1.9≥ 16.1.0, < 16.1.4+1 more2024-02-14

CVE-2024-23976 [MEDIUM] CWE-266 CVE-2024-23976: When running in Appliance mode, an authenticated attacker assigned the Administrator role may be abl When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2019-6651P4MEDIUMCVSS 5.3≥ 11.5.1, ≤ 11.6.4≥ 12.1.0, ≤ 12.1.4.1+4 more2019-09-25

CVE-2019-6651 [MEDIUM] CWE-203 CVE-2019-6651: In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request.

nvd

CVE-2022-26130P4MEDIUMCVSS 5.3v13.1.0v13.1.1+16 more2022-05-05

CVE-2022-26130 [MEDIUM] CWE-754 CVE-2022-26130: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions p On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software v

nvd

CVE-2022-29480P4MEDIUMCVSS 5.3v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-29480 [MEDIUM] CWE-400 CVE-2022-29480: On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple r On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

nvd

CVE-2022-29479P4MEDIUMCVSS 5.3v11.6.1v11.6.2+29 more2022-05-05

CVE-2022-29479 [MEDIUM] CWE-20 CVE-2022-29479: On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions p On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, when an IPv6 self IP address is configured and the ipv6.strictcompliance database key is enabled (disabled by default) on a BIG-IP

nvd

CVE-2022-27182P4MEDIUMCVSS 5.3v14.1.0v14.1.2+11 more2022-05-05

CVE-2022-27182 [MEDIUM] CWE-400 CVE-2022-27182: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versio On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual server is configured with the type set to Reject, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of T

nvd

CVE-2019-19151P4MEDIUMCVSS 5.5≥ 11.5.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.5+3 more2019-12-23

CVE-2019-19151 [MEDIUM] CWE-269 CVE-2019-19151: On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5 On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallo

nvd

CVE-2025-54500P4MEDIUMCVSS 5.3≥ 15.1.0, < 15.1.10.8≥ 16.1.0, < 16.1.6.1+2 more2025-08-13

CVE-2025-54500 [MEDIUM] CWE-770 CVE-2025-54500: An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control fr An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-42063P4MEDIUMCVSS 4.9≥ 17.1.0, ≤ 17.1.3≥ 17.5.0, ≤ 17.5.1+2 more2026-05-13

CVE-2026-42063 [MEDIUM] CWE-552 CVE-2026-42063: A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administra A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

CVE-2026-42781P4MEDIUMCVSS 6.5v21.0.0≥ 17.1.0, ≤ 17.1.3+1 more2026-05-13

CVE-2026-42781 [MEDIUM] CWE-835 CVE-2026-42781: When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethe When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nvd

← Previous22 / 27Next →