Medium · 4.3 CVE-2023-38419 EUVD-2023-42236GHSA-x3f8-jwjc-w444

BIG-IP and BIG-IQ iControl SOAP vulnerability

Published Aug 2, 2023 · Updated Oct 11, 2024 · Assigned by f5

Vendor: F5 Product: BIG-IP Product: BIG-IQ Category: Network devices

Description

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Vendor	Product	Affected	Fixed
F5	BIG-IP	17.1.0 – < 17.1.0.2, 16.1.0 – < 16.1.3.5, 15.1.0 – < 15.1.9.1, 14.1.0 – < 14.1.5.5, 13.1.0	17.1.0.2
F5	BIG-IQ	8.2.0, 8.3.0	—

References

https://my.f5.com/manage/s/article/K000133472 vendor-advisory