CVE-2014-2928
highPriorität · beachten · 52EPSS 0.401 · 99. PerzentilExploit · waffenfähigEUUSEPSS · bewertet 2026-10-27
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- exploit/linux/http/f5_icontrol_execF5 iControl Remote Root Command Executionwaffenfähig · metasploit
- EDB-34927F5 iControl - Remote Command Execution (Metasploit)funktional · exploit_db
betroffene Produkte (87)
Betroffene Produkte und Versionsbereiche.
- f5 big-ip access policy manager= 10.1.0nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager= 10.2.0nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager= 10.2.1nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager= 10.2.2nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager= 11.0.0nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.0.0nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.0.1nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.1.0nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.2.0nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.2.1nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 10.2.2nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager= 11.0.0nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
- f5 big-ip global traffic manager= 10.0.0nvdUScpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
- f5 big-ip global traffic manager= 10.0.1nvdUScpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (11)
Externe Belege — Patches, Meldungen, Analysen.
- http://seclists.org/fulldisclosure/2014/May/32cnnvd
- http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.htmlcnnvd
- https://support.f5.com/csp/article/K15220Patchcnnvd
- http://seclists.org/fulldisclosure/2014/May/32enisa_euvd
- http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.htmlenisa_euvd
- http://www.exploit-db.com/exploits/34927enisa_euvd
- http://www.osvdb.org/106728enisa_euvd
- http://seclists.org/fulldisclosure/2014/May/32nvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan