Unscored severity · published Jul 9, 2012
CVE-2012-1493
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before…
–
CVSS
63.1%
EPSS
No
On KEV
Description
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.
Exploitation
Is it being used?
Exploit prediction (EPSS)63.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B1
Big-ip 1000 · F5
All versions, or not specified · source: NVD
B1
Big-ip 11000 · F5
All versions, or not specified · source: NVD
B1
Big-ip 11050 · F5
All versions, or not specified · source: NVD
B1
Big-ip 1500 · F5
All versions, or not specified · source: NVD
B1
Big-ip 1600 · F5
All versions, or not specified · source: NVD
B2
Big-ip 2400 · F5
All versions, or not specified · source: NVD
B3
Big-ip 3400 · F5
All versions, or not specified · source: NVD
B3
Big-ip 3410 · F5
All versions, or not specified · source: NVD
B3
Big-ip 3600 · F5
All versions, or not specified · source: NVD
B3
Big-ip 3900 · F5
All versions, or not specified · source: NVD
B4
Big-ip 4100 · F5
All versions, or not specified · source: NVD
B5
Big-ip 5100 · F5
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1493
Vendor Advisory
http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html
www.theregister.co.uk
http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/
Exploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb
www.trustmatta.com
https://www.trustmatta.com/advisories/MATTA-2012-002.txt