CVE-2012-1493
F5 BIG-IP Multiple Versions - Unauthenticated SSH Login via Shared Private Key
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2012-1493.
PoCs published by Metasploit, David Kennedy (ReL1K), Florent Daigniere, including Metasploit module exploits/linux/ssh/f5_bigip_known_privkey.
AI-analyzed exploit summary This Metasploit module exploits CVE-2012-1493 by using a hardcoded RSA private key to authenticate as root via SSH on F5 BIG-IP appliances. It establishes an interactive shell session upon successful authentication.
Description
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.
Exploits (4)
This Metasploit module exploits CVE-2012-1493 by using a hardcoded RSA private key to authenticate as root via SSH on F5 BIG-IP appliances. It establishes an interactive shell session upon successful authentication.
This exploit leverages a hardcoded RSA private key to bypass authentication on F5 BIG-IP devices, allowing direct SSH access as root. The script automates the process by writing the key to a file, setting permissions, and initiating an SSH connection.
This advisory describes an authentication bypass vulnerability in F5 BIG-IP devices, where a hardcoded SSH private key allows unauthenticated root access. The vulnerability affects multiple versions of BIG-IP platforms without SCCP.
This Metasploit module exploits a known private SSH key exposure in F5 BIG-IP appliances, allowing passwordless root authentication. It uses a hardcoded RSA private key to authenticate and establish an interactive shell session.