CVE-2024-45844: F5 Big-ip Access Policy Manager authentication bypass (CVSS 7.2)

Description

BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

F5 Big-ip Access Policy Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Advanced Firewall Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Advanced Web Application Firewall≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Analytics≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Application Acceleration Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Application Security Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Application Visibility And Reporting≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Automation Toolchain≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Carrier-grade Nat≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Container Ingress Services≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Ddos Hybrid Defender≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Domain Name System≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Edge Gateway≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Fraud Protection Service≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Global Traffic Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Link Controller≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Local Traffic Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Policy Enforcement Manager≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip SSL Orchestrator≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Webaccelerator≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

F5 Big-ip Websafe≥ 15.1.0 < 15.1.10.5 · ≥ 16.1.0 < 16.1.5 · ≥ 17.1.0 < 17.1.1.4

Remediation

Fixed in

F5 Big-ip Access Policy Manager≥ 15.1.10.5

F5 Big-ip Advanced Firewall Manager≥ 15.1.10.5

F5 Big-ip Advanced Web Application Firewall≥ 15.1.10.5

F5 Big-ip Analytics≥ 15.1.10.5

F5 Big-ip Application Acceleration Manager≥ 15.1.10.5

F5 Big-ip Application Security Manager≥ 15.1.10.5

F5 Big-ip Application Visibility And Reporting≥ 15.1.10.5

F5 Big-ip Automation Toolchain≥ 15.1.10.5

F5 Big-ip Carrier-grade Nat≥ 15.1.10.5

F5 Big-ip Container Ingress Services≥ 15.1.10.5

Patch & vendor advisories

https://my.f5.com/manage/s/article/K000140061

References

https://my.f5.com/manage/s/article/K000140061Vendor Advisory
https://offsec.almond.consulting/privilege-escalation-f5-CVE-2024-45844.htmlExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-45844 being actively exploited?

CVE-2024-45844 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 10.6%.

How severe is CVE-2024-45844?

CVE-2024-45844 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 10.6% probability of exploitation.

Which products are affected by CVE-2024-45844?

Affected products include F5 Big-ip Access Policy Manager, F5 Big-ip Advanced Firewall Manager, F5 Big-ip Advanced Web Application Firewall, F5 Big-ip Analytics, F5 Big-ip Application Acceleration Manager, and 16 more.

How do I fix CVE-2024-45844?

Upgrade affected software to a fixed version, for example F5 Big-ip Access Policy Manager 15.1.10.5, F5 Big-ip Advanced Firewall Manager 15.1.10.5, F5 Big-ip Advanced Web Application Firewall 15.1.10.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-45844 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo