EUVD-2026-29985
GHSA-wqww-wgqj-gjvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
6DescriptionCVE.org
An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
AnalysisAI
BIG-IP QKView utility fails to properly sanitize sensitive data in diagnostic files, allowing authenticated attackers to extract confidential information including credentials and system configuration details. The vulnerability affects both BIG-IP and BIG-IQ platforms and requires valid user credentials to exploit, limiting exposure to insider threats and compromised accounts within authorized access tiers.
Technical ContextAI
BIG-IP's QKView utility is a diagnostic data collection tool that aggregates system configuration, logs, and performance metrics into a compressed archive for troubleshooting purposes. The vulnerability stems from improper sanitization (CWE-532: Insertion of Sensitive Information into Log Files) whereby sensitive data fields-likely including passwords, API tokens, SSL certificates, and authentication credentials-are included in QKView output without adequate redaction or encryption. The issue affects both the standalone BIG-IP product line and the management platform BIG-IQ, which share similar diagnostic infrastructure. An authenticated user with low-privilege access (PR:L in CVSS) can trigger QKView generation and subsequently read the resulting file to extract unredacted sensitive information that should have been scrubbed during collection or export.
RemediationAI
Apply the vendor-released patch from F5 advisory K000157895, which remediates the QKView sanitization defect across supported BIG-IP and BIG-IQ versions. Organizations unable to patch immediately should implement the following compensating controls: (1) Restrict QKView generation and file access to administrators only, removing permissions for low-privileged users-this eliminates the attack surface but reduces operational visibility for support teams; (2) Implement file-level encryption for QKView outputs at rest and in transit, protecting sensitive data within the file even if accessed by an unauthorized user-note this adds computational overhead and key management complexity; (3) Configure audit logging to detect QKView file access and generation by non-administrative accounts, enabling detection if a low-privileged user attempts exploitation; (4) If QKView files are shared externally with F5 support or contractors, use a secure file transfer channel and establish data sanitization procedures on the F5 side via F5 support case management. See F5 advisory K000157895 for patched versions and detailed remediation steps.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today