F5 BIG-IQ Application Delivery Controller vulnerabilities

9 CVEs affecting F5 BIG-IQ Application Delivery Controller, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-6128, published 2017-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0196: Linux Kernel Race Condition Vulnerability, published 2014-05-07. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 22.5% chance of exploitation in the next 30 days. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
CVE-2016-5022, published 2016-09-07. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and…
CVE-2015-5516, published 2016-01-20. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x, 11.5.x before 11.5.3 HF2, and 11.6.x…
CVE-2015-8099, published 2016-05-13. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before…
CVE-2017-6128, published 2017-05-01. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.
CVE-2016-5021, published 2016-06-24. Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days. The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before…
CVE-2016-2084, published 2016-04-13. High severity, CVSS 7.4. EPSS: 0.8% chance of exploitation in the next 30 days. F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build…
CVE-2014-4027, published 2014-06-23. Low severity, CVSS 2.3. EPSS: 0.7% chance of exploitation in the next 30 days. The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain…
CVE-2015-7393, published 2016-01-12. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM…