Medium · 5.5 CVE-2023-43485 EUVD-2023-47900GHSA-8rv8-vg5p-grcr

BIGIP and BIG-IQ TACACS+ audit log Vulnerability

Published Oct 10, 2023 · Updated Sep 18, 2024 · Assigned by f5

Vendor: F5 Product: BIG-IP Product: BIG-IQ Category: Network devices

Description

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Vendor	Product	Affected	Fixed
F5	BIG-IP	16.1.0 – < 16.1.4, 15.1.0 – < 15.1.9, 14.1.0, 13.1.0	16.1.4
F5	BIG-IQ	8.1.0, 8.2.0 – < 8.2.0.1.0.13.97-ENG, 8.3.0 – < 8.3.0.0.12.118-ENG	8.2.0.1.0.13.97-ENG

References

https://my.f5.com/manage/s/article/K06110200 vendor-advisory