{"id":"CVE-2023-46747","kind":"vulnerability","aliases":["CVE-2023-46747"],"related":[],"title":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to…","description":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"F5 BIG-IP's Configuration Utility has an authentication bypass that lets an unauthenticated attacker reach the management interface through alternate request paths. The attacker can then execute system commands on the BIG-IP appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-10-31T00:00:00+00:00","products":[{"name":"F5 BIG-IP Configuration Utility","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip domain name system","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["big-ip","exploited","f5","infrastructure","network-appliance","ransomware"],"not_affected_if":["no-big-ip-deployed"],"how_to_check":null,"fix":"Apply the mitigation or fix from the F5 vendor advisory, or discontinue use of the product if no mitigation is available (per CISA required action).","status":"open","published_at":"2023-10-26T21:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:20+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:04:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or fix from the F5 vendor advisory, or discontinue use of the product if no mitigation is available (per CISA required action).","reach":"network","impact":"high","summary":"F5 BIG-IP's Configuration Utility has an authentication bypass that lets an unauthenticated attacker reach the management interface through alternate request paths. The attacker can then execute system commands on the BIG-IP appliance.","category":"infrastructure","who_cares":["f5","big-ip","network-appliance"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker executes system commands on the BIG-IP appliance","analyst_note":"Sources do not list affected or fixed versions or the vendor mitigation steps; check the F5 security advisory for CVE-2023-46747 and the list of affected BIG-IP versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-big-ip-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000479,"input_tokens":2906,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':15A,18A,415C '-46747':16A,19A '-46748':416C 'access':13A,30A,37A,44A,51A,58A,387C 'action':419C 'address':401C 'advanced':65A,72A,79A,86A,93A,100A,108A,116A,124A,132A 'allow':8A,381C 'altern':342B,370C 'and/or':398C 'appli':420C 'applianc':319B,357B 'application':102A,110A,118A,126A,134A 'attack':10A,336B,346B,384C 'authent':7A,330B,366C 'big':22A,28A,35A,42A,49A,56A,63A,70A,77A,84A,91A,98A,106A,114A,122A,130A,138A,146A,154A,162A,170A,178A,185A,192A,199A,206A,213A,219A,225A,231A,237A,243A,250A,257A,264A,271A,278A,285A,292A,299A,306A,312B,323B,355B,360C,391C 'big-ip':21A,27A,34A,41A,48A,55A,62A,69A,76A,83A,90A,97A,105A,113A,121A,129A,137A,145A,153A,161A,169A,177A,184A,191A,198A,205A,212A,218A,224A,230A,236A,242A,249A,256A,263A,270A,277A,284A,291A,298A,305A,311B,322B,354B,359C,390C 'bypass':4A,331B,367C 'carrier':141A,149A,157A,165A,173A 'carrier-grade':140A,148A,156A,164A,172A 'channel':373C 'cisa':417C 'command':351B,405C 'configur':5A,326B,362C 'configuration':24A 'conjunct':412C 'contain':364C 'cve':14A,17A,414C 'ddos':180A,187A,194A,201A,208A 'defender':182A,189A,196A,203A,210A 'discontinu':426C 'domain':245A,252A,259A,266A,273A 'due':375C 'execut':349B,403C 'exploit':314B 'f5':20A,26A,33A,40A,47A,54A,61A,68A,75A,82A,89A,96A,104A,112A,120A,128A,136A,144A,152A,160A,168A,176A,183A,190A,197A,204A,211A,217A,223A,229A,235A,241A,248A,255A,262A,269A,276A,283A,290A,297A,304A,315B,321B,358C 'firewall':66A,73A,80A,87A,94A,103A,111A,119A,127A,135A 'grade':142A,150A,158A,166A,174A 'hybrid':181A,188A,195A,202A,209A 'infrastructur':316B 'instruct':424C 'interfac':340B 'ip':23A,29A,36A,43A,50A,57A,64A,71A,78A,85A,92A,99A,107A,115A,123A,131A,139A,147A,155A,163A,171A,179A,186A,193A,200A,207A,214A,220A,226A,232A,238A,244A,251A,258A,265A,272A,279A,286A,293A,300A,307A,313B,324B,356B,361C,392C,400C 'let':333B 'local':280A,287A,294A,301A,308A 'manag':339B,396C 'manager':32A,39A,46A,53A,60A,67A,74A,81A,88A,95A,282A,289A,296A,303A,310A 'may':3A,380C 'mitig':421C,432C 'name':246A,253A,260A,267A,274A 'nat':143A,151A,159A,167A,175A 'network':12A,318B,386C 'network-appli':317B 'orchestrator':216A,222A,228A,234A,240A 'path':344B,371C 'per':422C 'policy':31A,38A,45A,52A,59A 'port':397C 'product':430C 'ransomwar':320B 'reach':337B 'request':2A,343B,378C 'requir':418C 'self':399C 'ssl':215A,221A,227A,233A,239A 'system':247A,254A,261A,268A,275A,350B,393C,404C 'traffic':281A,288A,295A,302A,309A 'unauthent':335B,383C 'unavail':434C 'undisclos':1A,377C 'use':368C,410C,427C 'util':6A,327B,363C 'utility':25A 'vendor':423C 'vulner':374C,407C 'web':101A,109A,117A,125A,133A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-26T21:15:08+00:00","kev":{"dateAdded":"2023-10-31","dueDate":"2023-11-21","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f5sirt@f5.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-46747","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46747","severity":null,"published_at":"2023-10-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-46747","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46747","severity":null,"published_at":"2023-10-26T21:15:08+00:00","modified_at":"2026-06-17T06:31:32+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}