High severity · published Oct 10, 2023
CVE-2023-45226
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to…
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only exposed when ssh debug is enabled. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BN
Big-ip Next Service Proxy For Kubernetes · F5
1.5.0 · source: NVD
Affected product
BN
Big-ip Next Service Proxy For Kubernetes
F5
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45226
Vendor Advisory
https://my.f5.com/manage/s/article/K000135874
More from Big-ip Next Service Proxy For Kubernetes
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
7.5
CVE-2026-59762
BIG-IP HTTP/2 vulnerability
7.5
CVE-2026-40618
BIG-IP SSL/TLS vulnerability
7.5
CVE-2026-40629
BIG-IP SSL/TLS vulnerability
7.5
CVE-2025-61990
When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which…