CVE-2024-37028: BIG-IP Next Central Manager vulnerability
Published Aug 14, 2024
·Updated
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.
Affected Software
2 affected componentsFixes available
F5 BIG-IP Next Central Manager>=20.1.0<=20.2.0
20.2.1
F5 BIG-IP Next Central Manager>=20.1.0<20.2.1
Event History
Aug 14, 2024
Advisory Published
via F5·01:21 PM
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-37028?
CVE-2024-37028 is considered a significant vulnerability as it allows account lockout for users that have never logged in.
2
How do I fix CVE-2024-37028?
To fix CVE-2024-37028, upgrade the F5 BIG-IP Next Central Manager to a version that is not affected, specifically above 20.2.1.
3
What versions of F5 BIG-IP Next Central Manager are affected by CVE-2024-37028?
F5 BIG-IP Next Central Manager versions from 20.1.0 to 20.2.0 are affected by CVE-2024-37028.
4
Who is impacted by CVE-2024-37028?
Any user of the F5 BIG-IP Next Central Manager within the affected versions may be impacted by CVE-2024-37028.
5
Is CVE-2024-37028 exploitable remotely?
Yes, CVE-2024-37028 can potentially be exploited remotely by an attacker with access to the management interface.