Big Ip Next Central Manager
CVE-2024-32049
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-300. BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Affected products include: F5 Big-Ip Next Central Manager.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Big Ip Next Central Manager
View allThe Central Manager user session refresh token does not expire when a user logs out. Rated high severity (CVSS 8.9), thi
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase i
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Rated high severity (CVSS 7.5), this
An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Rated high severity (CVSS 7.5), th
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the B
An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impe
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive inf
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Rated medium sev
When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to bre
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can c
Same weakness CWE-300 – Channel Accessible by Non-Endpoint
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today