CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability

KEV

Analyzed

Published 26-10-2023Last modified 21-10-2025

Vulnerability summary

CVE-2023-46748 is a high (CVSS 8.8) SQL Injection vulnerability in F5 BIG-IP Configuration Utility. It is known to be exploited: CISA lists it, first on 31-10-2023. EPSS estimates a 4.47% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

4.47%

0%100%

Low · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

26-10-2023
PublishedVulnerability first disclosed.
31-10-2023
Added to CISA KEVExploitedF5 BIG-IP Configuration Utility SQL Injection Vulnerability
21-11-2023
CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21-10-2025
Last modifiedVulnerability information updated.

Description

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS metrics

2 scores · 2 sources · 1 version

v3.18.8

EPSS trend

Probability

4.47%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.47% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 31-10-2023
Federal due date: 21-11-2023

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. my.f5.com/manage/s/article/K000137365 nvd.nist.gov/vuln/detail/CVE-2023-46748

Public exploits

1 found

referenceUnverified
Exploit Reference (secpod.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

F521 products

big-ip≥ 17.1.0 (No fix recorded) | ≥ 16.1.0 (No fix recorded) | ≥ 15.1.0 (No fix recorded) | ≥ 14.1.0 (No fix recorded) | ≥ 13.1.0 (No fix recorded)
big-ip_access_policy_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_advanced_firewall_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_advanced_web_application_firewall≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_analytics≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1

big-ip_application_acceleration_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_application_security_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_application_visibility_and_reporting≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_automation_toolchain≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_carrier-grade_nat≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_container_ingress_services≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_ddos_hybrid_defender≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_domain_name_system≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_fraud_protection_services≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_global_traffic_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_link_controller≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_local_traffic_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_policy_enforcement_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_ssl_orchestrator≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_webaccelerator≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1
big-ip_websafe≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, ≤ 14.1.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.4 | ≥ 17.1.0, ≤ 17.1.1

Show all 21

1 vendor · 21 products

References

3 links

my.f5.com/manage/s/article/K000137365Vendor Advisory
www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ExploitThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748Government ResourceUS Government Resource