Multiple F5 BIG-IP Products Vulnerabilities

Severity

High

Analysis Summary

CVE-2024-28883 CVSS:7.4

F5 BIG-IP (APM) and APM Clients could allow a remote attacker to bypass security restrictions, caused by an origin validation flaw in browser network access VPN client. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass F5 endpoint inspection.

CVE-2024-32049 CVSS:7.4

F5 BIG-IP Next Central Manager is vulnerable to a man-in-the-middle attack, caused by a flaw in the SSL communication between BIG-IP Next LTM/WAF instance and BIG-IP Next Central Manager. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain BIG-IP Next LTM/WAF instance credentials.

CVE-2024-25560 CVSS:7.5

BIG-IP (AFM) is vulnerable to a denial of service, caused by a NULL pointer dereference flaw. By sending specially crafted DNS traffic, a remote attacker could exploit this vulnerability to cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2024-33608 CVSS:7.5

F5 BIG-IP is vulnerable to a denial of service, caused by a flaw when IPsec is configured on a virtual server. By sending a specially crafted traffic , a remote attacker could exploit this vulnerability to cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2024-26026 CVSS:8.6

F5 BIG-IP Next Central Manager is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements to the API, which could allow the attacker to view, add, modify or delete information in the back-end database.

CVE-2024-21793 CVSS:7.5

CVE-2024-31156 CVSS:8

F5 BIG-IP is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Configuration utility. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Impact