CVE-2023-43746: BIG-IP Appliance mode external monitor vulnerability

Vulnerability summary

CVE-2023-43746 is a high (CVSS 8.7) Privilege Defined With Unsafe Actions vulnerability in f5 big-ip. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.1% of scored vulnerabilities.

Timeline

1. 10-10-2023
   PublishedVulnerability first disclosed.
2. 18-09-2024
   Last modifiedVulnerability information updated.

Description

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CWE-267Privilege Defined With Unsafe ActionsA particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.