F5 BIG-IQ Cloud And Orchestration vulnerabilities

13 CVEs affecting F5 BIG-IQ Cloud And Orchestration, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-5209, published 2020-01-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0196: Linux Kernel Race Condition Vulnerability, published 2014-05-07. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 22.5% chance of exploitation in the next 30 days. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability, published 2018-09-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 14.7% chance of exploitation in the next 30 days. An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate…
CVE-2015-4047, published 2015-05-29. High severity, CVSS 7.8. EPSS: 9.7% chance of exploitation in the next 30 days. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.
CVE-2016-5022, published 2016-09-07. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and…
CVE-2014-5209, published 2020-01-08. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
CVE-2015-8099, published 2016-05-13. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before…
CVE-2017-6128, published 2017-05-01. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow.
CVE-2016-5021, published 2016-06-24. Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days. The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before…
CVE-2018-15322, published 2018-10-31. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0,…
CVE-2018-15321, published 2018-10-31. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow…

Latest

CVE-2018-5540, published 2018-07-19. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5…
CVE-2018-5516, published 2018-05-02. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow…