Skip to main content

Big Iq CVE-2014-3220

CRITICAL
Credentials Management Errors (CWE-255)
2014-05-05 cve@mitre.org
Authentication Bypass Big Iq F5
9.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
9.0 CRITICAL
AV:N/AC:L/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
C

Lifecycle Timeline

1
CVE Published
May 05, 2014 - 17:06 cve.org
CRITICAL 9.0

DescriptionCVE.org

F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/.

AnalysisAI

F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 31.9%.

Technical ContextAI

This vulnerability is classified under CWE-255. F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. Affected products include: F5 Big-Iq. Version information: through 4.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Big Iq

View all
CVE-2026-41957 HIGH
8.7 May 13

Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
CVE-2026-66842 HIGH
8.7 Sep 02

Privilege escalation in F5 BIG-IP and BIG-IQ allows any authenticated user - regardless of assigned role - to create adm
CVE-2026-40698 HIGH
8.5 May 13

Command injection in F5 BIG-IP and BIG-IQ SNMP configuration allows highly privileged Resource Administrators to escalat
CVE-2026-32643 HIGH
8.5 May 13

Configuration manipulation in F5 BIG-IP and BIG-IQ Certificate Manager allows authenticated attackers with high privileg
CVE-2026-42406 HIGH
8.5 May 13

Arbitrary command execution in F5 BIG-IP and BIG-IQ Certificate Manager allows highly privileged attackers with Certific
CVE-2026-20916 HIGH
7.2 May 13

Authenticated low-privilege users can write arbitrary files to the BIG-IQ system filesystem via path traversal in an und
CVE-2026-41219 HIGH
7.1 May 13

BIG-IP QKView utility fails to properly sanitize sensitive data in diagnostic files, allowing authenticated attackers to
CVE-2026-41959 HIGH
7.1 May 13

Incorrect permission assignment in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and iControl REST al
CVE-2026-42937 HIGH
7.1 May 13

Incorrect permission assignment in F5 BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl R
CVE-2026-41954 MEDIUM
6.9 May 13

Sensitive information disclosure in F5 BIG-IP and BIG-IQ allows authenticated administrators with resource administrator

Same weakness CWE-255 – Credentials Management Errors

View all
CVE-2014-1812 HIGH POC
8.8
CVE-2016-7456 CRITICAL POC
9.8
CVE-2012-1493 HIGH POC
7.8
CVE-2012-4933 HIGH POC
7.8
CVE-2013-4786 HIGH POC
7.5
CVE-2013-3502 MEDIUM POC
6.5
CVE-2015-7251 CRITICAL POC
9.8
CVE-2013-6884 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2014-3220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy