F5 BIG-IP Controller vulnerabilities

2 CVEs affecting F5 BIG-IP Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-5021, published 2019-05-08.

More from F5.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-5021, published 2019-05-08. Critical severity, CVSS 9.8. EPSS: 6.3% chance of exploitation in the next 30 days. Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of…
• CVE-2018-5543, published 2018-07-31. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 (k8s-bigip-crtl) passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the…