{"id":"CVE-2023-46748","kind":"vulnerability","aliases":["CVE-2023-46748"],"related":[],"title":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an…","description":"F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"F5 BIG-IP Configuration Utility has an SQL injection flaw that lets an authenticated attacker with network access to the management port or self IPs run system commands. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-10-31T00:00:00+00:00","products":[{"name":"F5 BIG-IP Configuration Utility","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip carrier-grade nat","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip ddos hybrid defender","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip ssl orchestrator","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"},{"name":"f5 big-ip automation toolchain","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip automation toolchain","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip automation toolchain","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip automation toolchain","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip automation toolchain","fixed":[],"affected":">= 17.1.0, <= 17.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["big-ip","exploited","f5","infrastructure","self-hosted"],"not_affected_if":["management-port-not-network-exposed","no-big-ip-deployed"],"how_to_check":null,"fix":"Apply the mitigations from the vendor (F5) instructions, or stop using the product if mitigations are unavailable, as CISA requires.","status":"open","published_at":"2023-10-26T21:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:20+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:04:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor (F5) instructions, or stop using the product if mitigations are unavailable, as CISA requires.","reach":"network","impact":"high","summary":"F5 BIG-IP Configuration Utility has an SQL injection flaw that lets an authenticated attacker with network access to the management port or self IPs run system commands. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["f5","big-ip","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"authenticated attacker runs system commands on the BIG-IP appliance","analyst_note":"Find the affected and fixed BIG-IP versions and the exact F5 mitigation steps; the KEV entry gives neither, so check the F5 advisory for CVE-2023-46748.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-big-ip-deployed","management-port-not-network-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2875,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':18A,21A,395C '-46747':396C '-46748':19A,22A 'access':33A,40A,47A,54A,61A,331B,370C 'action':399C 'activ':346B 'address':381C 'advanced':68A,75A,82A,89A,96A 'allow':16A,364C 'and/or':378C 'appli':400C 'attack':328B,367C 'authent':2A,327B,366C 'automation':278A,284A,290A,296A,302A 'big':10A,25A,31A,38A,45A,52A,59A,66A,73A,80A,87A,94A,101A,109A,117A,125A,133A,141A,148A,155A,162A,169A,176A,182A,188A,194A,200A,206A,213A,220A,227A,234A,241A,248A,255A,262A,269A,276A,282A,288A,294A,300A,305B,315B,353C,374C 'big-ip':9A,24A,30A,37A,44A,51A,58A,65A,72A,79A,86A,93A,100A,108A,116A,124A,132A,140A,147A,154A,161A,168A,175A,181A,187A,193A,199A,205A,212A,219A,226A,233A,240A,247A,254A,261A,268A,275A,281A,287A,293A,299A,304B,314B,352C,373C 'carrier':104A,112A,120A,128A,136A 'carrier-grade':103A,111A,119A,127A,135A 'cisa':342B,397C 'command':341B,385C 'configur':12A,317B,355C 'configuration':27A 'conjunct':392C 'contain':357C 'cve':17A,20A,394C 'ddos':143A,150A,157A,164A,171A 'defender':145A,152A,159A,166A,173A 'discontinu':406C 'enforcement':244A,251A,258A,265A,272A 'execut':383C 'exist':6A 'exploit':307B,347B 'f5':23A,29A,36A,43A,50A,57A,64A,71A,78A,85A,92A,99A,107A,115A,123A,131A,139A,146A,153A,160A,167A,174A,180A,186A,192A,198A,204A,211A,218A,225A,232A,239A,246A,253A,260A,267A,274A,280A,286A,292A,298A,308B,313B,351C 'firewall':69A,76A,83A,90A,97A 'flaw':323B 'grade':105A,113A,121A,129A,137A 'host':312B 'hybrid':144A,151A,158A,165A,172A 'infrastructur':309B 'inject':4A,322B,360C 'instruct':404C 'ip':11A,26A,32A,39A,46A,53A,60A,67A,74A,81A,88A,95A,102A,110A,118A,126A,134A,142A,149A,156A,163A,170A,177A,183A,189A,195A,201A,207A,214A,221A,228A,235A,242A,249A,256A,263A,270A,277A,283A,289A,295A,301A,306B,316B,338B,354C,375C,380C 'let':325B 'list':343B 'local':208A,215A,222A,229A,236A 'manag':334B,376C 'manager':35A,42A,49A,56A,63A,70A,77A,84A,91A,98A,210A,217A,224A,231A,238A,245A,252A,259A,266A,273A 'may':15A,363C 'mitig':401C,412C 'nat':106A,114A,122A,130A,138A 'network':330B,369C 'orchestrator':179A,185A,191A,197A,203A 'per':402C 'policy':34A,41A,48A,55A,62A,243A,250A,257A,264A,271A 'port':335B,377C 'product':410C 'requir':398C 'run':339B 'self':311B,337B,379C 'self-host':310B 'sql':3A,321B,359C 'ssl':178A,184A,190A,196A,202A 'system':340B,384C 'toolchain':279A,285A,291A,297A,303A 'traffic':209A,216A,223A,230A,237A 'unavail':414C 'use':390C,407C 'util':13A,318B,356C 'utility':28A 'vendor':403C 'vulner':5A,361C,387C 'wild':350B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-26T21:15:08+00:00","kev":{"dateAdded":"2023-10-31","dueDate":"2023-11-21","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f5sirt@f5.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-46748","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748","severity":null,"published_at":"2023-10-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-46748","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46748","severity":null,"published_at":"2023-10-26T21:15:08+00:00","modified_at":"2026-06-17T06:31:32+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}