BL
Product
Big-ip Link Controller
On CISA KEVExploited in the wildRansomware-linked
524
CVEs
11
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 36High 285Medium 179Low 0
Watch
Add Big-ip Link Controller to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-46747 RansomwareIn wildKEV | 9.8 | Oct 26 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability Affected: 13.1.0 through 13.1.5; 14.1.0 through 14.1.5; 15.1.0 through 15.1.10; 16.1.0 through 16.1.4; 17.1.0 through 17.1.1 |
| CVE-2022-1388 RansomwareIn wildKEV | 9.8 | May 5 | F5 BIG-IP Missing Authentication Vulnerability Affected: 11.6.1 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 before 13.1.5; 14.1.0 before 14.1.4.6; 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 |
| CVE-2021-22991 In wildKEV | 9.8 | Mar 31 | F5 BIG-IP Traffic Management Microkernel Buffer Overflow Affected: 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2021-22986 RansomwareIn wildKEV | 9.8 | Mar 31 | F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability Affected: 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2020-5902 RansomwareIn wildKEV | 9.8 | Jul 1 | F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability Affected: 11.6.1 before 11.6.5.2; 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.6; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.4 |
| CVE-2014-7169 In wildKEV | 9.8 | Sep 25 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: 10.0.0 through 10.2.4; 11.0.0 through 11.5.1; 11.6.0 |
| CVE-2014-6271 In wildKEV | 9.8 | Sep 24 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: 10.0.0 through 10.2.4; 11.0.0 through 11.5.1; 11.6.0 |
| CVE-2023-41373 | 9.9 | Oct 10 | A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.6; 15.1.0 before 15.1.10.2; 16.1.0 before 16.1.4.1; 17.1.0 before 17.1.0.3 |
| CVE-2021-22987 | 9.9 | Mar 31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in… Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2022-35728 | 9.8 | Aug 4 | iControl REST vulnerability CVE-2022-35728 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5.1; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3.1; 17.0.0 |
| CVE-2021-22992 | 9.8 | Mar 31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious… Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2019-6675 | 9.8 | Nov 26 | BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an… Affected: 15.0.1.0.33.11-eng_hotfix through 15.0.1.0.48.11-eng_hotfix; 14.1.0.3.0.79.6-eng_hotfix; 14.1.0.3.0.97.6-eng_hotfix; 14.1.0.3.0.99.6-eng_hotfix; 14.1.0.5.0.15.5-eng_hotfix; 14.1.0.5.0.36.5-eng_hotfix; +18 more |
| CVE-2019-6609 | 9.8 | Apr 15 | Platform dependent weakness Affected: 12.1.2 before 12.1.4.1; 13.0.0 before 13.1.1.4; 14.0.0 before 14.1.0.2; 12.1.1 |
| CVE-2018-5506 | 9.8 | Apr 13 | In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated… Affected: 11.5.1 through 11.5.5; 12.1.0 through 12.1.3.1; 11.2.1; 11.6.1; 13.0.0 |
| CVE-2017-6165 | 9.8 | Oct 20 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on… Affected: 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1; +4 more |
| CVE-2017-6131 | 9.8 | May 23 | In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into… Affected: 12.0.0; 12.1.0; 12.1.1; 12.1.2; 13.0.0 |
| CVE-2016-5700 | 9.8 | Oct 3 | Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2,… Affected: 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; +3 more |
| CVE-2016-5022 | 9.8 | Sep 7 | F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3;… Affected: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; +7 more |
| CVE-2015-8611 | 9.8 | Jan 12 | BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with… Affected: 12.0.0 |
| CVE-2021-23037 | 9.6 | Sep 14 | On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP… Affected: 11.6.0 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 through 13.1.4; 14.1.0 through 14.1.4; 15.1.0 through 15.1.3; 16.0.0 through 16.1.0 |
| CVE-2020-5948 | 9.6 | Dec 11 | On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a… Affected: 13.1.0 before 13.1.3.5; 14.1.0 before 14.1.2.8; 15.0.0 before 15.1.1; 16.0.0 |
| CVE-2019-6644 | 9.4 | Sep 4 | Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all… Affected: 12.1.3 through 12.1.4; 13.0.0 through 13.1.2; 14.0.0; 14.1.0 |
| CVE-2026-41225 | 9.1 | May 13 | iControl REST vulnerability Affected: 17.1.0 through 17.1.3; 17.5.0 through 17.5.1; 16.1.0 through 16.1.6; 21.0.0 |
| CVE-2022-35243 | 9.1 | Aug 4 | Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1; 16.1.0 before 16.1.3 |
| CVE-2022-34865 | 9.1 | Aug 4 | Traffic intelligence feeds vulnerability CVE-2022-34865 Affected: 13.1.0 through 13.1.5; 14.1.0 before 14.1.5; 15.1.0 before 15.1.6.1 |
| CVE-2022-26415 | 9.1 | May 5 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x,… Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.5; 14.1.0 before 14.1.4.6; 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 |
| CVE-2021-22989 | 9.1 | Mar 31 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running… Affected: 11.6.1 before 11.6.5.3; 12.1.0 before 12.1.5.3; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 |
| CVE-2020-5887 | 9.1 | Apr 30 | On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port… Affected: 14.1.0 through 14.1.2.3; 15.0.0 through 15.0.1.2; 15.1.0 through 15.1.0.1 |
| CVE-2020-5886 | 9.1 | Apr 30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers… Affected: 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.3; 15.0.0 through 15.1.0.1 |
| CVE-2020-5885 | 9.1 | Apr 30 | On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer… Affected: 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.3; 15.0.0 through 15.1.0.1 |
| CVE-2020-5884 | 9.1 | Apr 30 | On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring… Affected: 11.6.1 through 11.6.5.1; 12.1.0 through 12.1.5.1; 13.1.0 through 13.1.3.3; 14.1.0 through 14.1.2.4; 15.0.0 through 15.1.0.3 |
| CVE-2019-6649 | 9.1 | Sep 20 | F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive… Affected: 11.5.2 through 11.5.9; 11.6.1 through 11.6.4; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0; 14.1.0; +1 more |
| CVE-2019-10744 | 9.1 | Jul 26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution Affected: 12.1.0 before 12.1.5.2; 13.1.0 before 13.1.3.4; 14.1.0 before 14.1.2.5; 15.0.0 before 15.0.1.4; 15.1.0 before 15.1.0.2 |
| CVE-2019-6592 | 9.1 | Feb 26 | On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles Affected: 14.1.0 through 14.1.0.1 |
| CVE-2011-3188 | 9.1 | May 24 | The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes… Affected: 10.0.0 through 10.2.4; 11.0.0 through 11.1.0 |
| CVE-2021-23038 | 9.0 | Sep 14 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting (XSS)… Affected: 12.1.0 through 12.1.6; 13.1.0 before 13.1.4.1; 14.1.0 before 14.1.4.2; 15.1.0 before 15.1.3.1; 16.0.0 before 16.0.1.2 |
Showing 36
The 500 most important CVEs for this product (exploited first, then by severity)