CVE-2023-28742: BIG-IP iQuery mesh vulnerability
Published May 3, 2023
·Updated
When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
5 affected components
F5 Big-ip Domain Name System>=13.1.0<=13.1.5
F5 Big-ip Domain Name System>=14.1.0<14.1.5.4
F5 Big-ip Domain Name System>=15.1.0<15.1.8.2
F5 Big-ip Domain Name System>=16.1.0<16.1.3.4
F5 Big-ip Domain Name System>=17.0.0<17.1.0.1
Event History
May 3, 2023
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
DescriptionSeverityWeakness
Data Sourced
03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-28742.
2
What is the severity level of CVE-2023-28742?
The severity level of CVE-2023-28742 is high.
3
Which software versions are affected by CVE-2023-28742?
The affected software versions are F5 Big-ip Domain Name System versions 13.1.0 to 13.1.5, 14.1.0 to 14.1.5.3, 15.1.0 to 15.1.8.1, 16.1.0 to 16.1.3.3, and 17.0.0 to 17.1.0.
4
Is an authentication required for exploiting CVE-2023-28742?
Yes, an authentication is required for exploiting CVE-2023-28742.
5
How can I fix CVE-2023-28742?
To fix CVE-2023-28742, apply the necessary security patches provided by F5 Networks or upgrade to a non-vulnerable version of the F5 Big-ip Domain Name System software.