IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.8Mittel

CVE-2026-24464Appliance mode iControl REST vulnerability

F5 BIG-IP Veröffentlicht: (vor 5 Monaten)

Beschreibung

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Schwachstellentyp (CWE): CWE-35

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
F5 BIG-IP 21.0.0 – < 21.0.0.2, 17.5.0 – < 17.5.1.6, 17.1.0 – < 17.1.3.2, 16.1.0
f5 big-ip access policy manager 16.1.0 – ≤ 16.1.6
f5 big-ip advanced firewall manager 16.1.0 – ≤ 16.1.6
f5 big-ip advanced web application firewall 16.1.0 – ≤ 16.1.6
f5 big-ip analytics 16.1.0 – ≤ 16.1.6
f5 big-ip application acceleration manager 16.1.0 – ≤ 16.1.6
f5 big-ip application security manager 16.1.0 – ≤ 16.1.6
f5 big-ip application visibility and reporting 16.1.0 – ≤ 16.1.6
f5 big-ip automation toolchain 16.1.0 – ≤ 16.1.6
f5 big-ip carrier-grade nat 16.1.0 – ≤ 16.1.6
f5 big-ip container ingress services 16.1.0 – ≤ 16.1.6
f5 big-ip ddos hybrid defender 16.1.0 – ≤ 16.1.6
f5 big-ip domain name system 16.1.0 – ≤ 16.1.6
f5 big-ip edge gateway 16.1.0 – ≤ 16.1.6
f5 big-ip fraud protection service 16.1.0 – ≤ 16.1.6
f5 big-ip global traffic manager 16.1.0 – ≤ 16.1.6
f5 big-ip link controller 16.1.0 – ≤ 16.1.6
f5 big-ip local traffic manager 16.1.0 – ≤ 16.1.6
f5 big-ip policy enforcement manager 16.1.0 – ≤ 16.1.6
f5 big-ip ssl orchestrator 16.1.0 – ≤ 16.1.6
f5 big-ip webaccelerator 16.1.0 – ≤ 16.1.6
f5 big-ip websafe 16.1.0 – ≤ 16.1.6

Referenzen und Patches

CPE-Treffer (NVD) (60)
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.1.6
  • cpe:2.3:a:f5:big-ip_access_policy_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_analytics:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_application_security_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_automation_toolchain:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_carrier-grade_nat:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_container_ingress_services:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_domain_name_system:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_edge_gateway:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_link_controller:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_policy_enforcement_manager:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_ssl_orchestrator:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_webaccelerator:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_websafe:21.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1
  • cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3
  • cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1

Neue CVEs im selben Produkt — F5 BIG-IP

9.8Kritisch
CVE-2026-94127 KEV

BIG-IP APM OAuth vulnerability

F5 BIG-IP

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

27%EPSS
3.1Niedrig
CVE-2026-63020

BIG-IP Configuration utility vulnerability

F5 BIG-IP

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message …

8.8Hoch
CVE-2026-66842

BIG-IP and BIG-IQ Configuration utility vulnerability

F5 BIG-IP; F5 BIG-IQ

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attack…

7.5Hoch
CVE-2026-59762

BIG-IP HTTP/2 vulnerability

F5 BIG-IP; F5 BIG-IP Next for Kubernetes; F5 BIG-IP Next SPK; F5 BIG-IP Next CNF

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. …

7.5Hoch
CVE-2026-40423

BIG-IP SIP profile vulnerability

F5 BIG-IP

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5Hoch
CVE-2026-39458

BIG-IP DNS Cache vulnerability

F5 BIG-IP

When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have …