CVE-2023-46747 PoC — BIG-IP Configuration utility unauthenticated remote code execution vulnerability

Source

https://github.com/nvansluis/test_cve-2023-46747

Associated Vulnerability

Title: BIG-IP Configuration utility unauthenticated remote code execution vulnerability (CVE-2023-46747)
Description:Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Readme

Python script to test if a F5 BIG-IP is vulnerable for CVE-2023-46747.
When vulnerable a user account with administrator rights is added.

To mitigate this vulnerability, see: https://my.f5.com/manage/s/article/K000137353

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →