CVE-2012-2997: F5 BIG-IP Configuration Utility

Medium severity, CVSS 4.0. EPSS: 6.4% chance of exploitation in the next 30 days.

XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file.

Affected products

• F5 BIG-IP Configuration Utility: version 10.0.0 only; version 10.2.4 only; version 11.0.0 only; version 11.2.1 only

Published 2014-01-21. Last modified 2026-06-16.