F5 BIG-IP WAN Optimization Manager vulnerabilities

38 CVEs affecting F5 BIG-IP WAN Optimization Manager, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-3587, published 2020-02-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2014-0196: Linux Kernel Race Condition Vulnerability, published 2014-05-07. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 22.5% chance of exploitation in the next 30 days. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
CVE-2015-3628, published 2015-12-07. High severity, CVSS 9.0. EPSS: 69.3% chance of exploitation in the next 30 days. The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before…
CVE-2014-2928, published 2014-05-12. High severity, CVSS 7.1. EPSS: 40.1% chance of exploitation in the next 30 days. The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1,…
CVE-2014-8730, published 2014-12-10. Medium severity, CVSS 4.3. EPSS: 13.7% chance of exploitation in the next 30 days. The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge…
CVE-2015-4047, published 2015-05-29. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
CVE-2014-2927, published 2014-10-15. High severity, CVSS 9.3. EPSS: 7.9% chance of exploitation in the next 30 days. The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x…
CVE-2014-0101, published 2014-03-11. High severity, CVSS 7.8. EPSS: 7.2% chance of exploitation in the next 30 days. The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call,…
CVE-2015-4040, published 2015-09-17. Medium severity, CVSS 4.0. EPSS: 6.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the…

Latest

CVE-2013-3587, published 2020-02-21. Medium severity, CVSS 5.9. EPSS: 6% chance of exploitation in the next 30 days. The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle…
CVE-2014-5209, published 2020-01-08. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2014-4024, published 2018-03-19. Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days. SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used…
CVE-2016-7469, published 2017-06-09. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM,…
CVE-2014-6031, published 2017-06-08. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and…
CVE-2016-6876, published 2016-09-07. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3; BIG-IP…
CVE-2016-5022, published 2016-09-07. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and…
CVE-2016-5023, published 2016-08-26. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote…
CVE-2016-1497, published 2016-08-26. Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days. The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x before 11.6.1, and 12.0.0 before HF1…
CVE-2016-5736, published 2016-08-19. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and…