ZeroDay Findings
Sign inSign up

Findings

CVE-2023-46748

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

Published Oct 26, 2023 · updated Jun 16, 2026 · f5 big-ip access policy manager

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2023 · Catalog

    Detected

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  2. Oct 31, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Nov 21, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Nov 21, 2023

Affected

  • cpe f5/big-ip access policy managerversion unspecified
  • cpe f5/big-ip advanced firewall managerversion unspecified
  • cpe f5/big-ip carrier-grade natversion unspecified
  • cpe f5/big-ip ddos hybrid defenderversion unspecified
  • cpe f5/big-ip local traffic managerversion unspecified
  • cpe f5/big-ip ssl orchestratorversion unspecified
  • vendor F5 BIG-IP Configuration Utilityversion unspecified

Sources

  • CISA KEVCVE-2023-46748

    F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

    cisa.gov
  • CVE.orgCVE-2023-46748

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-46748

    30-day exploitation probability 4.5%

    first.org
  • NIST NVDCVE-2023-46748

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

    nvd.nist.gov

References