{"vulnerability": "CVE-2021-23031", "sightings": [{"uuid": "6388746b-a180-44ee-9cb4-b44b87e3d235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=636", "content": "", "creation_timestamp": "2021-08-26T04:00:00.000000Z"}, {"uuid": "1b3dc465-10f4-4a35-ac94-d66eb4bf4410", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/CyberGovIL/1320", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05de\u05d5\u05e6\u05e8\u05d9 BigIP/BigIQ \u05e9\u05dc \u05d7\u05d1\u05e8\u05ea Com8765 |  F5\n\n\u05d7\u05d1\u05e8\u05ea F5 \u05e4\u05e8\u05e1\u05de\u05d4 \u05dc\u05d0\u05d7\u05e8\u05d5\u05e0\u05d4 \u05d4\u05ea\u05e8\u05e2\u05d5\u05ea \u05d0\u05d1\u05d8\u05d7\u05d4 \u05e2\u05d1\u05d5\u05e8 29 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05e9\u05d4\u05ea\u05d2\u05dc\u05d5 \u05d1\u05e6\u05d9\u05d5\u05d3 \u05de\u05e1\u05d5\u05d2 BigIP/BigIQ \u05de\u05ea\u05d5\u05e6\u05e8\u05ea\u05d4.\n\n13 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05de\u05e1\u05d5\u05d5\u05d2\u05d5\u05ea \u05d1\u05e1\u05d9\u05d5\u05d5\u05d2 \u05d2\u05d1\u05d5\u05d4. \u05de\u05ea\u05d5\u05db\u05df, \u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05d0\u05d7\u05ea \u05e2\u05dc\u05d5\u05dc\u05d4 \u05dc\u05d4\u05d9\u05d5\u05ea \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1\u05d4\u05d9\u05e0\u05ea\u05df \u05d4\u05e4\u05e2\u05dc\u05d4 \u05e9\u05dc \u05d4\u05e6\u05d9\u05d5\u05d3 \u05d1-Appliance Mode (CVE-2021-23031).\n\n\u05de\u05d5\u05de\u05dc\u05e5 \u05dc\u05d1\u05d7\u05d5\u05df \u05d0\u05ea \u05e2\u05d3\u05db\u05d5\u05e0\u05d9 \u05d4\u05d0\u05d1\u05d8\u05d7\u05d4 \u05d4\u05e8\u05dc\u05d5\u05d5\u05e0\u05d8\u05d9\u05d9\u05dd \u05dc\u05e6\u05d9\u05d5\u05d3 \u05e9\u05d1\u05e8\u05e9\u05d5\u05ea\u05db\u05dd, \u05d5\u05dc\u05d4\u05ea\u05e7\u05d9\u05e0\u05dd \u05d1\u05d4\u05e7\u05d3\u05dd \u05d4\u05d0\u05e4\u05e9\u05e8\u05d9.", "creation_timestamp": "2021-08-29T12:28:19.000000Z"}, {"uuid": "5735523a-75e9-421e-80ec-b797e88fdd5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityIL/4999", "content": "\u05d7\u05d5\u05dc\u05e9\u05d4 \u05e7\u05e8\u05d9\u05d8\u05d9\u05ea \u05d1\u05de\u05d5\u05e6\u05e8\u05d9 F5 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05dc\u05ea\u05d5\u05e7\u05e3, \u05e9\u05d4\u05e6\u05dc\u05d9\u05d7 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05ea\u05d4\u05dc\u05d9\u05da \u05d4\u05d6\u05d3\u05d4\u05d5\u05ea \u05dc\u05de\u05e2\u05e8\u05db\u05ea, \u05dc\u05e7\u05d1\u05dc \u05d2\u05d9\u05e9\u05ea \u05e0\u05d9\u05d4\u05d5\u05dc \u05de\u05dc\u05d0\u05d4.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4 \u05e4\u05d5\u05e8\u05e1\u05de\u05d4 \u05d1\u05de\u05e1\u05d2\u05e8\u05ea \u05d4\u05e2\u05d3\u05db\u05d5\u05df \u05e9\u05e4\u05d9\u05e8\u05e1\u05de\u05d4 \u05d4\u05d7\u05d5\u05d3\u05e9 \u05d7\u05d1\u05e8\u05ea F5 \u05d4\u05db\u05d5\u05dc\u05dc \u05d8\u05d9\u05e4\u05d5\u05dc \u05d1-30 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05e9\u05d5\u05e0\u05d5\u05ea.\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4 \u05d4\u05e7\u05e8\u05d9\u05d8\u05d9\u05ea (CVE-2021-23031) \u05e8\u05dc\u05d5\u05d5\u05e0\u05d8\u05d9\u05ea \u05dc\u05de\u05d5\u05e6\u05e8\u05d9 WAF \u05d5-ASM \u05d5\u05ea\u05e7\u05e4\u05d4 \u05d2\u05dd \u05d1\u05de\u05db\u05d5\u05e0\u05d5\u05ea \u05d5\u05d9\u05e8\u05d8\u05d5\u05d0\u05dc\u05d9\u05d5\u05ea \u05d5\u05d2\u05dd \u05d1\u05de\u05db\u05d5\u05e0\u05d5\u05ea \u05e4\u05d9\u05d6\u05d9\u05d5\u05ea.\n\n\u05d4\u05e4\u05e8\u05e1\u05d5\u05dd \u05e9\u05dc \u05d7\u05d1\u05e8\u05ea F5 \u05db\u05d5\u05dc\u05dc \u05d4\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea \u05d4\u05ea\u05e7\u05d9\u05e0\u05d5\u05ea \u05de\u05e4\u05d5\u05e8\u05e1\u05dd \u05db\u05d0\u05df\n\nhttps://t.me/CyberSecurityIL/1263\n\nhttps://www.bleepingcomputer.com/news/security/critical-f5-big-ip-bug-impacts-customers-in-sensitive-sectors/", "creation_timestamp": "2021-08-26T11:47:18.000000Z"}, {"uuid": "7d87c789-e723-431f-af58-6f9951956a88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/cibsecurity/28838", "content": "\u203c CVE-2021-23031 \u203c\n\nOn version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-14T22:23:20.000000Z"}, {"uuid": "8a305354-bd64-4200-82d0-a4537dd40753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/hacking_Attack/21599", "content": "Black Hat Ethical Hacking\nF5 Bug Could Lead to Complete System Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png F5 Bug Could Lead to Complete System TakeoverPost Views: 17 \nReading Time: 2 Minutes\nApplication delivery and networking firm F5 released a baker\u2019s dozen of 13 fixes for high-severity bugs, including one that could lead to complete system takeover and hence is boosted to \u201ccritical\u201d for customers that run BIG-IP in Appliance Mode\nF5 \u2013 maker of near-ubiquitously installed enterprise networking gear \u2013 released nearly 30 vulnerabilities for multiple devices in its August security updates.\n\nThe worst of the bunch is tracked as CVE-2021-23031\u00a0and affects BIG-IP modules Advanced WAF (Web Application Firewall) and the Application Security Manager (ASM) \u2013 specifically, the Traffic Management User Interface (TMUI).\n\nF5 said that when the vulnerability is exploited, \u201can authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services,\u201d potentially leading to \u201ccomplete system compromise.\u201d\n\nCVE-2021-23031 normally entails a high rating of 8.8 severity, but that gets jacked up to 9.9 for just those customers that are using Appliance mode. The Appliance mode adds technical restrictions and is designed to meet the needs of customers in \u201cespecially sensitive sectors\u201d by \u201climiting the BIG-IP system administrative access to match that of a typical network appliance and not a multi-user UNIX device.\u201d\n\nF5 lists a number of products that contain the affected code but aren\u2019t vulnerable, given that attackers can\u2019t exploit the code in default, standard or recommended configurations. F5 noted that there are a limited number of customers using it in the mode \u2013 i.e., Appliance mode \u2013 that elevates the vulnerability\u2019s CVSSv3 severity score to 9.9 (critical).\nSee Also: Complete Offensive Security and Ethical Hacking Course No Viable MitigationF5 said that there\u2019s \u201cno viable mitigation\u201d that also allows users access to the Configuration utility, given that this attack can be pulled off by legitimate, authenticated users. The only way to mitigate is to pull the access of any users who aren\u2019t \u201ccompletely trusted,\u201d according to the advisory.\n\nCustomers who can\u2019t install a fixed version right off the bat can use the following temporary mitigations, which restrict access to the Configuration utility to only trusted networks or devices and thereby limit the attack surface:\n\n* Block Configuration utility access through self IP addresses\n* Block Configuration utility access through the management interface\n\nMichael Haugh, Vice President at network automation provider Gluware, told Threatpost that known vulnerabilities are challenging to respond to quickly or to mitigate speedily: As it is, network operation crews are \u201cunder\u00a0the gun to keep the network highly available, secure and delivering the required performance for the business applications,\u201d he said. \u201cVendor vulnerabilities that require an OS Upgrade or patch can be very labor-intensive and potentially disruptive.\u201d\n\nVia email, Haugh observed that when it comes to a load balancer like F5, redundancy \u201cmust be part of the device\u201d and traffic \u201cmust be re-directed off an active device, taking it out of service to perform an upgrade.\u201d\n\nNot just once, mind you, but, often, multiple times: \u201cThis process often has to be repeated over dozens or even hundreds of devices depending on the organization. Having automated processes to pre-check, stage the image, gracefully execute the upgrades and complete post-checks can significantly improve the ability for NetOps to respond and execute a low-risk upgrade.\u201d\nSee Also: Critical[...]", "creation_timestamp": "2026-09-01T20:02:27.266395Z"}, {"uuid": "b88e2f9e-9c4b-44b8-bcbe-de8e2ce30852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/hacking_Attack/21600", "content": "Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets The Other Dozen BugsBesides the critical CVE-2021-23031 flaw, the dozen high-severity security bugs addressed in this month\u2019s patch release and listed in the table below have risk scores of between 7.2 and 7.5. The flaws include authenticated remote command execution (RCE), cross-site scripting (XSS) and request forgery, as well as insufficient permission and denial-of-service (DOS).\n\nHalf of them affect all modules, five impact the Advanced WAF and ASM, and one affects the DNS module.\n\nCVE / Bug ID Severity CVSS score Affected products Affected versions Fixes introduced in CVE-2021-23025 High 7.2 BIG-IP (all modules) 15.0.0 \u2013 15.1.0\n14.1.0 \u2013 14.1.3\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.0.0\n15.1.0.5\n14.1.3.1\n13.1.3.5 CVE-2021-23026 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.2\n13.1.4.1 BIG-IQ 8.0.0 \u2013 8.1.0\n7.0.0 \u2013 7.1.0\n6.0.0 \u2013 6.1.0 None CVE-2021-23027 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3 CVE-2021-23028 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.2\n13.1.4 CVE-2021-23029 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23030 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23031 High\n\n \n\u2014\n\nCritical \u2013 Appliance mode only\n8.8\n\n \n\u2014\n\n9.9\nBIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.5\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.1\n13.1.4\n12.1.6\n11.6.5.3 CVE-2021-23032 High 7.5 BIG-IP (DNS) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.4 CVE-2021-23033 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23034 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3 16.1.0\n15.1.3.1 CVE-2021-23035 High 7.5 BIG-IP (all modules) 14.1.0 \u2013 14.1.4 14.1.4.4 CVE-2021-23036 High 7.5 BIG-IP (Advanced WAF, ASM, DataSafe) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23037 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.1.0\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 None CISA Security AdvisoryThe Cybersecurity and Infrastructure Security Agency (CISA) issued a security advisory\u00a0encouraging users and admins to review F5\u2019s security advisory\u00a0and to update the software or to apply mitigations ASAP.\n\n\u201cDon\u2019t delay\u201d is, of course, good advice when it comes to F5 equipment, given that the company\u2019s enterprise networking can be found in some of the largest tech companies in the world, including Facebook, Microsoft and Oracle. It\u2019s also found in the halls of a trove of Fortune 500 companies, including some of the world\u2019s biggest financial institutions and ISPs.\nSee Also: Offensive Security Tool: FFUF F5: Prime Pickings for PestsAll that gear is also gleefully picked apart by attackers. Case in point: CVE 2020-5902, a critical vulnerability in F5 Networks\u2019 BIG-IP advanced delivery controller networking devices that, as of July 2020, was being exploited by attackers to scrape credentials, launch malware and more, was recently featured in CISA\u2019s list of top 30 bugs\u00a0\u201croutinely\u201d exploited in 2020 and into this year.\n\nJonathan Chua, application security consultant at app security provider nVisium, noted that F5 Big IP has been targeted by security researchers and adversaries due to the product\u2019s vulnerable, external nature. \u201cSeveral F5 application services can be hosted externally, allowing[...]", "creation_timestamp": "2026-09-01T20:02:26.159092Z"}, {"uuid": "c2a15d02-cf45-42e7-b091-33b5cdf8e991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/hacking_Attack/21600", "content": "Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets The Other Dozen BugsBesides the critical CVE-2021-23031 flaw, the dozen high-severity security bugs addressed in this month\u2019s patch release and listed in the table below have risk scores of between 7.2 and 7.5. The flaws include authenticated remote command execution (RCE), cross-site scripting (XSS) and request forgery, as well as insufficient permission and denial-of-service (DOS).\n\nHalf of them affect all modules, five impact the Advanced WAF and ASM, and one affects the DNS module.\n\nCVE / Bug ID Severity CVSS score Affected products Affected versions Fixes introduced in CVE-2021-23025 High 7.2 BIG-IP (all modules) 15.0.0 \u2013 15.1.0\n14.1.0 \u2013 14.1.3\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.0.0\n15.1.0.5\n14.1.3.1\n13.1.3.5 CVE-2021-23026 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.2\n13.1.4.1 BIG-IQ 8.0.0 \u2013 8.1.0\n7.0.0 \u2013 7.1.0\n6.0.0 \u2013 6.1.0 None CVE-2021-23027 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3 CVE-2021-23028 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.2\n13.1.4 CVE-2021-23029 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23030 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23031 High\n\n \n\u2014\n\nCritical \u2013 Appliance mode only\n8.8\n\n \n\u2014\n\n9.9\nBIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.5\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.1\n13.1.4\n12.1.6\n11.6.5.3 CVE-2021-23032 High 7.5 BIG-IP (DNS) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.4 CVE-2021-23033 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23034 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3 16.1.0\n15.1.3.1 CVE-2021-23035 High 7.5 BIG-IP (all modules) 14.1.0 \u2013 14.1.4 14.1.4.4 CVE-2021-23036 High 7.5 BIG-IP (Advanced WAF, ASM, DataSafe) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23037 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.1.0\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 None CISA Security AdvisoryThe Cybersecurity and Infrastructure Security Agency (CISA) issued a security advisory\u00a0encouraging users and admins to review F5\u2019s security advisory\u00a0and to update the software or to apply mitigations ASAP.\n\n\u201cDon\u2019t delay\u201d is, of course, good advice when it comes to F5 equipment, given that the company\u2019s enterprise networking can be found in some of the largest tech companies in the world, including Facebook, Microsoft and Oracle. It\u2019s also found in the halls of a trove of Fortune 500 companies, including some of the world\u2019s biggest financial institutions and ISPs.\nSee Also: Offensive Security Tool: FFUF F5: Prime Pickings for PestsAll that gear is also gleefully picked apart by attackers. Case in point: CVE 2020-5902, a critical vulnerability in F5 Networks\u2019 BIG-IP advanced delivery controller networking devices that, as of July 2020, was being exploited by attackers to scrape credentials, launch malware and more, was recently featured in CISA\u2019s list of top 30 bugs\u00a0\u201croutinely\u201d exploited in 2020 and into this year.\n\nJonathan Chua, application security consultant at app security provider nVisium, noted that F5 Big IP has been targeted by security researchers and adversaries due to the product\u2019s vulnerable, external nature. \u201cSeveral F5 application services can be hosted externally, allowing[...]", "creation_timestamp": "2026-09-02T01:02:59.726975Z"}, {"uuid": "87c43dfc-d0cd-47df-8cc4-0771c9906c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/hacking_Attack/21599", "content": "Black Hat Ethical Hacking\nF5 Bug Could Lead to Complete System Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png F5 Bug Could Lead to Complete System TakeoverPost Views: 17 \nReading Time: 2 Minutes\nApplication delivery and networking firm F5 released a baker\u2019s dozen of 13 fixes for high-severity bugs, including one that could lead to complete system takeover and hence is boosted to \u201ccritical\u201d for customers that run BIG-IP in Appliance Mode\nF5 \u2013 maker of near-ubiquitously installed enterprise networking gear \u2013 released nearly 30 vulnerabilities for multiple devices in its August security updates.\n\nThe worst of the bunch is tracked as CVE-2021-23031\u00a0and affects BIG-IP modules Advanced WAF (Web Application Firewall) and the Application Security Manager (ASM) \u2013 specifically, the Traffic Management User Interface (TMUI).\n\nF5 said that when the vulnerability is exploited, \u201can authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services,\u201d potentially leading to \u201ccomplete system compromise.\u201d\n\nCVE-2021-23031 normally entails a high rating of 8.8 severity, but that gets jacked up to 9.9 for just those customers that are using Appliance mode. The Appliance mode adds technical restrictions and is designed to meet the needs of customers in \u201cespecially sensitive sectors\u201d by \u201climiting the BIG-IP system administrative access to match that of a typical network appliance and not a multi-user UNIX device.\u201d\n\nF5 lists a number of products that contain the affected code but aren\u2019t vulnerable, given that attackers can\u2019t exploit the code in default, standard or recommended configurations. F5 noted that there are a limited number of customers using it in the mode \u2013 i.e., Appliance mode \u2013 that elevates the vulnerability\u2019s CVSSv3 severity score to 9.9 (critical).\nSee Also: Complete Offensive Security and Ethical Hacking Course No Viable MitigationF5 said that there\u2019s \u201cno viable mitigation\u201d that also allows users access to the Configuration utility, given that this attack can be pulled off by legitimate, authenticated users. The only way to mitigate is to pull the access of any users who aren\u2019t \u201ccompletely trusted,\u201d according to the advisory.\n\nCustomers who can\u2019t install a fixed version right off the bat can use the following temporary mitigations, which restrict access to the Configuration utility to only trusted networks or devices and thereby limit the attack surface:\n\n* Block Configuration utility access through self IP addresses\n* Block Configuration utility access through the management interface\n\nMichael Haugh, Vice President at network automation provider Gluware, told Threatpost that known vulnerabilities are challenging to respond to quickly or to mitigate speedily: As it is, network operation crews are \u201cunder\u00a0the gun to keep the network highly available, secure and delivering the required performance for the business applications,\u201d he said. \u201cVendor vulnerabilities that require an OS Upgrade or patch can be very labor-intensive and potentially disruptive.\u201d\n\nVia email, Haugh observed that when it comes to a load balancer like F5, redundancy \u201cmust be part of the device\u201d and traffic \u201cmust be re-directed off an active device, taking it out of service to perform an upgrade.\u201d\n\nNot just once, mind you, but, often, multiple times: \u201cThis process often has to be repeated over dozens or even hundreds of devices depending on the organization. Having automated processes to pre-check, stage the image, gracefully execute the upgrades and complete post-checks can significantly improve the ability for NetOps to respond and execute a low-risk upgrade.\u201d\nSee Also: Critical[...]", "creation_timestamp": "2026-09-02T01:03:00.308926Z"}]}