CVE-2023-3470: BIG-IP FIPS HSM password vulnerability CVE-2023-3470
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.
The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.
The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated attacker with TMOS Shell (tmsh) access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. On vCMP systems, all Guests share the same deterministic password, allowing those with tmsh access on one Guest to access FIPS HSM partitions belonging to other Guests.
— F5
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3470?
The severity of CVE-2023-3470 is considered high due to the predictable nature of the generated passwords.
How do I fix CVE-2023-3470?
To fix CVE-2023-3470, upgrade F5 BIG-IP to the latest versions as detailed in the vulnerability advisory.
What platforms are affected by CVE-2023-3470?
CVE-2023-3470 affects specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards, particularly versions 16.0.0, 15.1.1, and earlier.
Who is impacted by CVE-2023-3470?
Authenticated users with TMSH access to the BIG-IP system and individuals with physical access to the FIPS HSM are impacted by CVE-2023-3470.
What are the implications of CVE-2023-3470?
The implications of CVE-2023-3470 include potential unauthorized access to sensitive accounts due to weak, predictable passwords.