CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
Vulnerability summary
CVE-2023-46747 is a critical (CVSS 9.8) vulnerability in F5 BIG-IP Configuration Utility. It is known to be exploited: CISA and ENISA list it, first on 31-10-2023. It has been used in ransomware campaigns. EPSS estimates a 96.52% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 26-10-2023PublishedVulnerability first disclosed.
- 31-10-2023Added to CISA KEVF5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
- 21-11-2023CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 23-01-2025Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
96.52%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 96.52% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 31-10-2023
- Federal due date
- 21-11-2023
ENISA CNWListed- Added
- 23-01-2025
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. my.f5.com/manage/s/article/K000137353 nvd.nist.gov/vuln/detail/CVE-2023-46747
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (secpod.com)
Maturity: unknown
F5 BIG-IP TMUI AJP Smuggling RCE
exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
F521 products
- big-ip≥ 17.1.0 (No fix recorded) | ≥ 16.1.0 (No fix recorded) | ≥ 15.1.0 (No fix recorded) | ≥ 14.1.0 (No fix recorded) | ≥ 13.1.0 (No fix recorded)
- big-ip_access_policy_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
- big-ip_advanced_firewall_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
- big-ip_advanced_web_application_firewall≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
- big-ip_analytics≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
1 vendor · 21 products
References
4 links- my.f5.com/manage/s/article/K000137353Vendor Advisory
- packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.htmlExploitThird Party AdvisoryVDB Entry
- www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747Government ResourceUS Government Resource