CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection, actively exploited

Description

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

F5 Big-ip Access Policy Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Advanced Firewall Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Advanced Web Application Firewall≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Analytics≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Application Acceleration Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Application Security Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Application Visibility And Reporting≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Automation Toolchain≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Carrier-grade Nat≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Container Ingress Services≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Ddos Hybrid Defender≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Domain Name System≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Fraud Protection Services≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Global Traffic Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Link Controller≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Local Traffic Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Policy Enforcement Manager≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip SSL Orchestrator≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Webaccelerator≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

F5 Big-ip Websafe≥ 13.1.0 ≤ 13.1.5 · ≥ 14.1.0 ≤ 14.1.5 · ≥ 15.1.0 ≤ 15.1.10 · ≥ 16.1.0 ≤ 16.1.4

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://my.f5.com/manage/s/article/K000137365

References

https://my.f5.com/manage/s/article/K000137365Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748US Government Resource
https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-46748 being actively exploited?

Yes. CVE-2023-46748 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 31 Oct 2023.

How severe is CVE-2023-46748?

CVE-2023-46748 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 4.47% probability of exploitation.

Which products are affected by CVE-2023-46748?

Affected products include F5 Big-ip Access Policy Manager, F5 Big-ip Advanced Firewall Manager, F5 Big-ip Advanced Web Application Firewall, F5 Big-ip Analytics, F5 Big-ip Application Acceleration Manager, and 15 more.

How do I fix CVE-2023-46748?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-46748 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo