BIG-IP Configuration utility unauthenticated remote code execution vulnerability

published 2023-10-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-50916

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2023-10-31, used in ransomware
epss: 96.7%; EPSS 96.7% chance of exploitation in 30 days, percentile 99.8%
public exploits: 1; Metasploit, plus a Nuclei check

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

fixed in 1

F5 BIG-IP Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso, Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso, Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso, Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso, Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso, Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso

Timeline

2023-10-26 First public exploit (Metasploit exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747)
2023-10-26 Published
2023-10-31 Added to CISA KEV
2023-11-21 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 3 y ago (2023-10-31)
Patch by: 2023-11-21 (2 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: F5, BIG-IP Configuration Utility
CISA name: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

RansomHub ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

96.71% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747 F5 BIG-IP TMUI AJP Smuggling RCE metasploit exploit, excellent rank, 2023-10-26
Nuclei template F5 BIG-IP - Unauthenticated RCE via AJP Smuggling nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified
secpod.com https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

F5 BIG-IP

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-306 Missing Authentication for Critical Functionality

References

packetstormsecurity.com /files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
exploit, third-party-advisory, vdb-entry
secpod.com /blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/
exploit, third-party-advisory
my.f5.com /manage/s/article/K000137353
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747
government-resource, us-government-resource

Sources

CVE List CVE-2023-46747
NVD CVE-2023-46747

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary