CVE-2014-2928: f5 big-ip_access_policy_manager
Vulnerability summary
CVE-2014-2928 is a high (CVSS 7.1) vulnerability in f5 big-ip_access_policy_manager. EPSS estimates a 40.05% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 12-05-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
40.05%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+1.00 pp
From 39.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundF5 iControl - Remote Command Execution (Metasploit)
Maturity: weaponized
F5 iControl Remote Root Command Execution
exploit/linux/http/f5_icontrol_exec
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
F59 products
- big-ip_access_policy_manager10.1.0 | 10.2.0 | 10.2.1 | 10.2.2 | 11.0.0
- big-ip_application_security_manager10.0.0 | 10.0.1 | 10.1.0 | 10.2.0 | 10.2.1 | 10.2.2 | 11.0.0
- big-ip_edge_gateway10.1.0 | 10.2.0 | 10.2.1 | 10.2.2 | 11.0.0
- big-ip_global_traffic_manager10.0.0 | 10.0.1 | 10.1.0 | 10.2.0 | 10.2.1 | 10.2.2 | 11.0.0
- big-ip_link_controller10.0.0 | 10.0.1 | 10.1.0 | 10.2.0 | 10.2.1 | 10.2.2 | 11.0.0
1 vendor · 9 products