Critical severity · published Apr 15, 2019
CVE-2019-6609
Platform dependent weakness
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Big-ip Access Policy Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BA
Big-ip Advanced Firewall Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BA
Big-ip Analytics · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BA
Big-ip Application Acceleration Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BA
Big-ip Application Security Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BD
Big-ip Domain Name System · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BE
Big-ip Edge Gateway · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BF
Big-ip Fraud Protection Service · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BG
Big-ip Global Traffic Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BL
Big-ip Link Controller · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BL
Big-ip Local Traffic Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6609
Vendor Advisory
https://support.f5.com/csp/article/K18535734
More from Big-ip Access Policy Manager
9.8
CVE-2026-94127
BIG-IP APM OAuth vulnerability
9.8
CVE-2025-53521
BigIP APM Vulnerability
9.8
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
9.8
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
9.8
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
