CVE-2023-22374

HIGH

F5 BIG-IP Access Policy Manager 14.1.4.6-14.1.5 - Authenticated Format String Injection via iControl SOAP

Title source: llm
STIX 2.1

Description

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References (1)

Core 1
Core References

Scores

CVSS v3 8.5
EPSS 0.7265
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-134
Status published
Products (34)
f5/big-ip_access_policy_manager 13.1.5
f5/big-ip_access_policy_manager 17.0.0
f5/big-ip_access_policy_manager 14.1.4.6 - 14.1.5
f5/big-ip_advanced_firewall_manager 13.1.5
f5/big-ip_advanced_firewall_manager 17.0.0
f5/big-ip_advanced_firewall_manager 14.1.4.6 - 14.1.5
f5/big-ip_analytics 13.1.5
f5/big-ip_analytics 17.0.0
f5/big-ip_analytics 14.1.4.6 - 14.1.5
f5/big-ip_application_acceleration_manager 13.1.5
... and 24 more
Published Feb 01, 2023
Tracked Since Feb 18, 2026