CVE-2014-2927

F5 Arx - Authentication Bypass

Title source: rule

Description

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

Exploits (1)

exploitdb WRITEUP

by Security-Assessment.com · textremotehardware

https://www.exploit-db.com/exploits/34465

View Code ZIP pw:eip

References (3)

[Exploit] http://www.exploit-db.com/exploits/34465

[Exploit] http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf

[Vendor Advisory] https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html

Scores

EPSS 0.0742

EPSS Percentile 91.6%

Classification

CWE

CWE-287

Status draft

Affected Products (50)

f5/arx

f5/arx

f5/arx

f5/arx

f5/arx

f5/arx

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

f5/big-ip_access_policy_manager

... and 35 more

Timeline

Published Oct 15, 2014

Tracked Since Feb 18, 2026