F5 BIG-IP DDoS Hybrid Defender

BIG-IP DNS cache vulnerability

TMM vulnerability

BIG-IP SSL/TLS vulnerability

BIG-IP SSL/TLS vulnerability

BIG-IP Configuration utility vulnerability

BIG-IP DNS Cache vulnerability

BIG-IP SIP profile vulnerability

BIG-IP PEM iRules vulnerability

BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability

BIG-IP TMM Vulnerability

BIG-IP HTTP/2 vulnerability

BIG-IP DTLS Vulnerability

BIG-IP iControl SOAP vulnerability

BIG-IP Privilege Escalation vulnerability

BIG-IP iControl SOAP vulnerability

BIG-IP DTLS 1.2 Vulnerability

BIG-IP scripted monitor vulnerability

iControl REST and TMSH vulnerability

BIG-IP and BIG-IQ privilege escalation vulnerability

BIG-IP and BIG-IQ privilege escalation vulnerability

BIG-IP monitors vulnerability

iControl REST and tmsh vulnerability

iControl SOAP vulnerability

BIG-IP Configuration utility and tmsh vulnerability

BIG-IP Configuration utility XSS vulnerability

On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

BIG-IP tmsh vulnerability

BIG-IP MPTCP vulnerability

BIG-IP TMM vulnerability

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

BIG-IP HSB vulnerability

Multi-blade VIPRION Configuration utility session cookie vulnerability

BIG-IP Configuration utility XSS vulnerability

BIG-IP Configuration utility vulnerability

BIG-IP Edge Client for macOS vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.