F5 SSL Orchestrator vulnerabilities

27 CVEs affecting F5 SSL Orchestrator, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-23004, published 2021-03-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability, published 2020-07-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration…
CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability, published 2021-03-31. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before…
CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow, published 2021-03-31. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-18. EPSS: 61.1% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be…
CVE-2021-22992, published 2021-03-31. Critical severity, CVSS 9.8. EPSS: 72.7% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an…
CVE-2021-22987, published 2021-03-31. Critical severity, CVSS 9.9. EPSS: 13.7% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3 when running in Appliance mode, the…
CVE-2021-22988, published 2021-03-31. High severity, CVSS 8.8. EPSS: 10.4% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the…
CVE-2021-22989, published 2021-03-31. Critical severity, CVSS 9.1. EPSS: 8.8% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode…
CVE-2021-22990, published 2021-03-31. High severity, CVSS 7.2. EPSS: 8.8% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, on systems with Advanced WAF or…
CVE-2019-6630, published 2019-07-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances.
CVE-2017-6130, published 2017-04-06. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT…

Latest

CVE-2021-23004, published 2021-03-31. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding…
CVE-2021-23003, published 2021-03-31. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the Traffic Management Microkernel…
CVE-2021-23001, published 2021-03-31. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP…
CVE-2021-23000, published 2021-03-31. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile…
CVE-2021-22999, published 2021-03-31. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes…
CVE-2021-22998, published 2021-03-31. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, SYN flood protection thresholds…
CVE-2021-22994, published 2021-03-31. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl…