DESCRIPTION:
A vulnerability(CVE-2023-46747) in F5 Networks BIG-IP products may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.
AFFECTED RELEASES:
BIG-IP(All modules) version:
17.1.0-17.1.1
16.1.0-16.1.4
15.1.0-15.1.10
14.1.0-14.1.5
13.1.0-13.1.5
SOLUTION:
1. Users and system administrators of affected products are advised to refer to the official webpage (https://my.f5.com/manage/s/article/K000137353) of the “Security Advisory Status” part and apply the security updates:
(1) Connect to the website: https://my.f5.com/manage/s/downloads.
(2) Download the update file according to the module and version you are using.
(3) Use the device's management page to update to the latest version.
2. If you are currently using a version for which patches have not been released because support has been discontinued, it is recommended that you upgrade to a version that is still supported and for which patches have been released.
REFERENCE:
1. https://www.ithome.com.tw/news/159530
2. https://nvd.nist.gov/vuln/detail/CVE-2023-46747
3. https://my.f5.com/manage/s/article/K000137368
4. https://my.f5.com/manage/s/article/K000137353
5. https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/