F5 BIG-IQ ADC vulnerabilities

7 CVEs affecting F5 BIG-IQ ADC, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-5209, published 2020-01-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3628, published 2015-12-07. High severity, CVSS 9.0. EPSS: 69.3% chance of exploitation in the next 30 days. The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before…
CVE-2015-4047, published 2015-05-29. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
CVE-2014-0101, published 2014-03-11. High severity, CVSS 7.8. EPSS: 7.2% chance of exploitation in the next 30 days. The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call,…
CVE-2015-7394, published 2015-11-06. High severity, CVSS 9.0. EPSS: 3.9% chance of exploitation in the next 30 days. The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway,…
CVE-2014-5209, published 2020-01-08. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2015-5058, published 2015-08-24. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ…
CVE-2015-4637, published 2015-07-16. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND…