CVE-2017-6168: f5 big-ip_afm Observable Discrepancy
Vulnerability summary
CVE-2017-6168 is a high (CVSS 7.4) Observable Discrepancy vulnerability in f5 big-ip_afm. EPSS estimates a 19.64% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself, aka a ROBOT attack.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
19.64%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 19.64% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundScanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5
auxiliary/scanner/ssl/bleichenbacher_oracle
Maturity: poc
Weaknesses
CWE · root causeAffected systems
F59 products
- big-ip_afm≥ 11.6.0, ≤ 11.6.2 | ≥ 12.0.0, ≤ 12.1.2 | 13.0.0
- big-ip_analytics≥ 11.6.0, ≤ 11.6.2 | ≥ 12.0.0, ≤ 12.1.2 | 13.0.0
- big-ip_apm≥ 11.6.0, ≤ 11.6.2 | ≥ 12.0.0, ≤ 12.1.2 | 13.0.0
- big-ip_application_acceleration_manager≥ 11.6.0, ≤ 11.6.2 | ≥ 12.0.0, ≤ 12.1.2 | 13.0.0
- big-ip_asm≥ 11.6.0, ≤ 11.6.2 | ≥ 12.0.0, ≤ 12.1.2 | 13.0.0
1 vendor · 9 products