✕
Request a Demo
Rewterz
Rewterz Threat Advisory – ICS: Multiple Siemens Products Vulnerabilities
February 19, 2024
Rewterz
Rewterz Threat Update – Akira Ransomware Gang Exploits High-Severity Cisco ASA/FTD Vulnerability
February 19, 2024

Rewterz Threat Advisory – Multiple F5 Products Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2024-23306 CVSS:4.4

F5 BIG-IP Next CNF could allow a local authenticated attacker to obtain sensitive information, caused by improper access control. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive files information, and use this information to launch further attacks against the affected system.

CVE-2024-23976 CVSS:6

F5 BIG-IP could allow a local authenticated attacker to bypass security restrictions, caused by improper access control when running in Appliance mode. By sending a specially crafted request utilize iAppsLX templates, an attacker could exploit this vulnerability to bypass Appliance mode restrictions.

CVE-2024-23607 CVSS:5.5

F5 F5OS-A and F5OS-C could allow a local authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially crafted URL request containing “dot dot” sequences (/../) to view arbitrary files on the system.

CVE-2024-24966 CVSS:6.2

F5 F5OS-A and F5OS-C could allow a local attacker to bypass security restrictions, caused by a flaw when LDAP remote authentication is configured. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass intended access restrictions.

CVE-2024-21782 CVSS:6.7

F5 BIG-IP and BIG-IQ Centralized Management could allow a local authenticated attacker to execute arbitrary commands on the system, caused by improper access control by the secure copy (scp) utility. By sending a specially crafted command string, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

Impact

  • Gain Access
  • Security Bypass
  • Information Disclosure

Indicators Of Compromise

CVE

  • CVE-2024-23306
  • CVE-2024-23976
  • CVE-2024-23607
  • CVE-2024-24966
  • CVE-2024-21782

Affected Vendors

F5

Affected Products

  • F5 BIG-IP 15.1.0
  • F5 BIG-IP 16.1.0
  • F5 BIG-IQ Centralized Management 8.0.0
  • F5 BIG-IP 16.1.3
  • F5 BIG-IP 15.1.8
  • F5 F5OS-C 1.3.0
  • F5 BIG-IP 17.1.0
  • F5 BIG-IQ Centralized Management 8.3.0
  • F5 BIG-IP Next CNF 1.1.0
  • F5 BIG-IP Next CNF 1.1.1
  • F5 F5OS-A 1.3.0
  • F5 F5OS-A 1.3.2
  • F5 F5OS-C 1.5.1
  • F5 F5OS-A 1.2.0

Remediation

Refer to F5 Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2024-23306

CVE-2024-23976

CVE-2024-23607

CVE-2024-24966

CVE-2024-21782