7.8

CVE-2012-1493: f5 big-ip_application_security_manager Credentials Management Errors

CVSS: 7.8v2.0HighModified
Published 09-07-2012Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2012-1493 is a high (CVSS 7.8) Credentials Management Errors vulnerability in f5 big-ip_application_security_manager. EPSS estimates a 63.08% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk
54/100
0100
High · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
63.08%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits5github, exploit-database, metasploit

Timeline

  1. 09-07-2012
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

63.08%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 63.08% on 18-09-2026

18-09-202618-10-2026
EPSS score
63.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found
  • githubUnverified

    Metasploit Framework

    Maturity: poc

  • exploit-databasedoshardwareVerified

    F5 BIG-IP - Authentication Bypass (PoC)

    Maturity: poc

  • exploit-databaseremotehardwareVerified

    F5 BIG-IP - Authentication Bypass

    Maturity: weaponized

Show all 5 exploits
  • exploit-databaseremotehardwareVerified

    F5 BIG-IP - SSH Private Key Exposure (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    F5 BIG-IP SSH Private Key Exposure

    exploit/linux/ssh/f5_bigip_known_privkey

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

F55 products
  • big-ip_application_security_manager9.2.0 | 9.2.0:hf4 | 9.4.4 | 9.4.5 | 9.4.6 | 9.4.7 | 9.4.8 | 10.0.0 | 10.0.1 | 10.2.3:hf1 | 11.0.0 | 11.0.0:hf1 | 11.1.0 | 11.1.0:hf2
  • big-ip_global_traffic_manager9.2.2 | 9.4.8:hf4 | 10.0.0 | 10.2.3:hf1 | 11.0.0 | 11.0.0:hf1 | 11.1.0 | 11.1.0:hf2
  • big-ip_local_traffic_manager9.0.0 | 9.4.8:hf4 | 10.0.0 | 10.2.3:hf1 | 11.0.0 | 11.0.0:hf1 | 11.1.0 | 11.1.0:hf2
  • enterprise_manager1.0 | 2.0 | 2.1.0 | 2.1.0:hf1 | 2.2.0 | 2.3.0 | 2.3.0:hf2
  • tmos2.0 | 4.0 | 4.2 | 4.3 | 4.4 | 4.5 | 4.5.6 | 4.5.9 | 4.5.10 | 4.5.11 | 4.5.12 | 4.6 | 4.6.2 | 9.0 | 9.0.1 | 9.0.2 | 9.0.3 | 9.0.4 | 9.0.5 | 9.1 | 9.1.1 | 9.1.2 | 9.1.3 | 9.2 | 9.2.2 | 9.2.3 | 9.2.4 | 9.2.5 | 9.3 | 9.3.1 | 9.4 | 9.4.1 | 9.4.2 | 9.4.3 | 9.4.4 | 9.4.5 | 9.4.6 | 9.4.7 | 9.4.8 | 9.6.0 | 9.6.1 | 10.0.0 | 10.0.1 | 10.1.0 | 10.2.0

1 vendor · 5 products

References

4 links