VARIoT IoT vulnerabilities database

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings. BIG-IP Virtual Edition (VE) Exists in a vulnerability related to the leakage of resources to the wrong area.Information may be obtained and tampered with. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. There are security vulnerabilities in F5 BIG-IP versions 15.1.0 to 15.1.0.1, 15.0.0 to 15.0.1.2, and 14.1.0 to 14.1.2.3. The vulnerability is caused by the program not authenticating properly

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring. BIG-IP There is a cryptographic strength vulnerability in.Information may be obtained and tampered with. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP system due to the program's use of an insecure communication channel to transmit sensitive encrypted objects. A remote attacker can exploit this vulnerability to read and modify Diffie-Hellman (DH) parameters. The following products and versions are affected: F5 BIG-IP from version 15.0.0 to version 15.1.0.1, version 14.1.0 to version 14.1.2.3, version 13.1.0 to version 13.1.3.3, version 12.1.0 to version 12.1.5.1

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request. BIG-IP and BIG-IQ There is an unspecified vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in F5 BIG-IP and BIG-IQ. The following products and versions are affected: F5 BIG-IP 15.0.0 to 15.0.1, 14.1.0 to 14.1.2.3, 13.1.0 to 13.1.3.1, 12.1.0 to 12.1.5 , version 11.6.1 to version 11.6.5; BIG-IQ version 5.2.0 to version 7.1.0

On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file. BIG-IP There is an unspecified vulnerability in.Service operation interruption (DoS) It may be put into a state

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace. BIG-IP There is an information leakage vulnerability in.Information may be obtained. Both F5 BIG-IP and F5 BIG-IQ are products of the US company F5. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IQ is a software-based cloud management solution. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. A security vulnerability exists in F5 BIG-IP and BIG-IQ. The following products and versions are affected: F5 BIG-IP version 15.0.0 to 15.0.1, 14.1.0 to 14.1.2.3, 13.1.0 to 13.1.3.3 and 12.1.0 to 12.1.5.1 ; BIG-IQ version 5.2.0 to version 7.1.0

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory. BIG-IP Edge Client A buffer error vulnerability exists in the component.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. F5 BIG-IP APM, etc. are all products of F5 Company in the United States. F5 BIG-IP APM is an access and security solution. F5 BIG-IP APM Clients is a set of APM client software. F5 BIG-IP Edge Gateway is a remote access solution. Security vulnerabilities exist in F5 BIG-IP APM, BIG-IP Edge Gateway, and BIG-IP APM Clients

On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event. BIG-IP There is an unspecified vulnerability in.Service operation interruption (DoS) It may be put into a state

On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service. BIG-IP There is an input verification vulnerability in.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. A remote attacker could exploit this vulnerability to cause a denial of service. The following products and versions are affected: F5 BIG-IP from version 15.0.0 to version 15.1.0.1, version 14.1.0 to version 14.1.2.3, version 13.1.0 to version 13.1.3.3, version 12.1.0 to version 12.1.5.1 and versions 11.6.1 through 11.6.5.1

On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up. BIG-IP Exists in a race condition vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. A remote attacker could exploit this vulnerability to take control of the connection, impersonate a peer-to-peer trusted device, and extract or modify sensitive information on the system. The following products and versions are affected: 15.0.0 to 15.0.1.3, 14.1.0 to 14.1.2.3, 13.1.0 to 13.1.3.3, 12.1.0 to 12.1.5.1 and 11.6.1 Version to version 11.6.5.1. F5 BIG-IP could allow a remote malicious user to bypass security restrictions, caused by a race condition in the mcpd

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring. plural BIG-IP The product contains a cryptographic strength vulnerability.Information may be obtained and tampered with. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A remote attacker could exploit this vulnerability to read and modify the keys of EXPORT-based cipher suites. The following products and versions are affected: F5 BIG-IP from version 15.0.0 to version 15.1.0.1, version 14.1.0 to version 14.1.2.3, version 13.1.0 to version 13.1.3.3, version 12.1.0 to version 12.1.5.1

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes. BIG-IP Virtual Edition (VE) There is an unspecified vulnerability in.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. Security vulnerabilities exist in F5 BIG-IP versions 15.0.0 through 15.1.0.1, 14.1.0 through 14.1.2.3, and 13.1.0 through 13.1.3.3. A remote attacker could exploit this vulnerability to cause a denial of service

On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring. BIG-IP There is a cryptographic strength vulnerability in.Information may be obtained and tampered with. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. A remote attacker could exploit this vulnerability to bypass security restrictions. The following products and versions are affected: F5 BIG-IP 15.0.0 to 15.1.0.3, 14.1.0 to 14.1.2.4, 13.1.0 to 13.1.3.3, 12.1.0 to 12.1.5.1 , version 11.6.1 to version 11.6.5.1

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local daemons and bypass port lockdown settings. BIG-IP Virtual Edition (VE) There is an unspecified vulnerability in.Information may be obtained and tampered with. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. Security vulnerabilities exist in F5 BIG-IP versions 15.1.0 through 15.1.0.1, 15.0.0 through 15.0.1.2, and 14.1.0 through 14.1.2.3

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak. BIG-IP Is vulnerable to a lack of resource release after a valid lifetime.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. The following products and versions are affected: 15.0.0 to 15.0.1, 14.1.0 to 14.1.2.3, 14.0.0 to 14.0.1, and 13.1.0 to 13.1.3.1

On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure. BIG-IP There is an unspecified vulnerability in.Service operation interruption (DoS) It may be put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in F5 BIG-IP versions 14.1.0 through 14.1.2.3. A remote attacker could exploit this vulnerability to cause a denial of service

On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied. BIG-IP ASM There is a vulnerability in the lack of encryption of critical data.Information may be obtained. F5 BIG-IP ASM is a Web Application Firewall (WAF) of F5 Corporation in the United States, which provides secure remote access, protects emails, simplifies Web access control, and enhances network and application performance. A security vulnerability exists in F5 BIG-IP ASM versions 11.6.1 through 11.6.5.1. A remote attacker could exploit this vulnerability to obtain sensitive information

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection. BIG-IP Edge Client There is an information leakage vulnerability in.Information may be obtained. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A remote attacker could exploit this vulnerability to launch a man-in-the-middle attack by deploying a malicious captive portal

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client. BIG-IP APM portal access Exists in a cross-site scripting vulnerability.Information may be obtained and tampered with. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The product provides unified access to business-critical applications and networks. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traffic data in the system, it will result in no response for a long time and memory overflow risk. This affects: ZENIC ONE R22b versions V16.19.10P02SP002 and V16.19.10P02SP005. ZENIC ONE R22b Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be put into a state. ZTE ZENIC ONE R22b is a set of network SDN (software defined network) intelligent management and control system of China ZTE Corporation (ZTE). The system includes functions such as network management, network control, network information collection and analysis. A local attacker can use RPC to exploit this vulnerability to cause a denial of service

ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the request, the caller can directly view the internal error code location of the component. Attackers could exploit this vulnerability to obtain sensitive information. This affects: OSCP versions V16.19.10 and V16.19.20. This vulnerability stems from configuration errors in network systems or products during operation