F5 BIG-IP Service Proxy vulnerabilities

3 CVEs affecting F5 BIG-IP Service Proxy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23555, published 2023-02-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2002-20001, published 2021-11-11. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE…
CVE-2023-23555, published 2023-02-01. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile…
CVE-2023-22664, published 2023-02-01. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a…