CVE-2017-6161
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.…
Published 9 y ago · modified 4 mo ago · JSON
Summary
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion.
Exploit prediction (EPSS)
0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 2.9 | AV:A/AC:M/Au:N/C:N/I:N/A:P |
Affected products
- F5 Networks, Inc. BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator
Classification
- Weakness
- CWE-400 Uncontrolled Resource Consumption
References
- support.f5.com /csp/article/K62279530 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039676 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/101636 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039675 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2017-6161
- NVD: CVE-2017-6161
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.