F5-K26910459
First published: Tue Oct 10 2023(Updated: )
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST, the BIG-IP non-admin user can still access the iControl REST admin resource.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 BIG-IP and BIG-IQ Centralized Management | 17.1.0 | |
| F5 BIG-IP and BIG-IQ Centralized Management | >=16.1.0<=16.1.3 | 16.1.4 |
| F5 BIG-IP and BIG-IQ Centralized Management | >=15.1.0<=15.1.8 | 15.1.9 |
| F5 BIG-IP and BIG-IQ Centralized Management | >=14.1.0<=14.1.5 | |
| F5 BIG-IP and BIG-IQ Centralized Management | >=13.1.0<=13.1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of F5-K26910459?
The severity of F5-K26910459 is classified as critical due to the potential unauthorized access to admin resources.
How do I fix F5-K26910459?
To resolve F5-K26910459, upgrade the affected BIG-IP version to a fixed release as recommended in F5 advisories.
Who is affected by F5-K26910459?
Non-admin users who have been temporarily assigned administrator roles on F5 BIG-IP systems are affected by F5-K26910459.
What version of F5 BIG-IP is vulnerable to F5-K26910459?
F5-K26910459 affects F5 BIG-IP versions 15.1.0 to 15.1.9, 16.1.0 to 16.1.4, 17.1.0, and versions from 14.1.0 to 14.1.5.
Is there a workaround for F5-K26910459?
A workaround for F5-K26910459 is to ensure that no non-admin users are assigned admin roles and to monitor role assignments closely.
- agent/references
- agent/last-modified-date
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/f5-advisory
- source/F5
- alias/CVE-2023-42768
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/f5
- canonical/f5 big-ip and big-iq centralized management
- version/f5 big-ip and big-iq centralized management/16.1.0
- version/f5 big-ip and big-iq centralized management/16.1.3
- version/f5 big-ip and big-iq centralized management/15.1.0
- version/f5 big-ip and big-iq centralized management/15.1.8
- version/f5 big-ip and big-iq centralized management/14.1.0
- version/f5 big-ip and big-iq centralized management/14.1.5
- version/f5 big-ip and big-iq centralized management/13.1.0
- version/f5 big-ip and big-iq centralized management/13.1.5