---
id: "CVE-2023-46748"
kind: "vulnerability"
aliases: ["CVE-2023-46748"]
title: "An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an\u2026"
severity: "critical"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "F5 BIG-IP Configuration Utility", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip carrier-grade nat", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip carrier-grade nat", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip carrier-grade nat", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip carrier-grade nat", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip carrier-grade nat", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip ddos hybrid defender", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip ddos hybrid defender", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip ddos hybrid defender", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip ddos hybrid defender", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip ddos hybrid defender", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip ssl orchestrator", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip ssl orchestrator", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip ssl orchestrator", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip ssl orchestrator", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip ssl orchestrator", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip local traffic manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip local traffic manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip local traffic manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip local traffic manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip local traffic manager", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip policy enforcement manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip policy enforcement manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip policy enforcement manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip policy enforcement manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip policy enforcement manager", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}, {"name": "f5 big-ip automation toolchain", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip automation toolchain", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip automation toolchain", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip automation toolchain", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip automation toolchain", "fixed": [], "affected": ">= 17.1.0, <= 17.1.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["big-ip", "exploited", "f5", "infrastructure", "self-hosted"]
not_affected_if: ["management-port-not-network-exposed", "no-big-ip-deployed"]
published_at: "2023-10-26T21:15:08+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46748", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an…

F5 BIG-IP Configuration Utility has an SQL injection flaw that lets an authenticated attacker with network access to the management port or self IPs run system commands. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:F5 BIG-IP Configuration Utility affected ? fixed ?
- vendor:f5 big-ip access policy manager affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip access policy manager affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip access policy manager affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip access policy manager affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip access policy manager affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip advanced firewall manager affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip advanced firewall manager affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip advanced firewall manager affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip advanced firewall manager affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip advanced firewall manager affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip carrier-grade nat affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip carrier-grade nat affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip carrier-grade nat affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip carrier-grade nat affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip carrier-grade nat affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip ddos hybrid defender affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip ddos hybrid defender affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip ddos hybrid defender affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip ddos hybrid defender affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip ddos hybrid defender affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip ssl orchestrator affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip ssl orchestrator affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip ssl orchestrator affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip ssl orchestrator affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip ssl orchestrator affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip local traffic manager affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip local traffic manager affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip local traffic manager affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip local traffic manager affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip local traffic manager affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip policy enforcement manager affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip policy enforcement manager affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip policy enforcement manager affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip policy enforcement manager affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip policy enforcement manager affected >= 17.1.0, <= 17.1.1 fixed ?
- vendor:f5 big-ip automation toolchain affected >= 13.1.0, <= 13.1.5 fixed ?
- vendor:f5 big-ip automation toolchain affected >= 14.1.0, <= 14.1.5 fixed ?
- vendor:f5 big-ip automation toolchain affected >= 15.1.0, <= 15.1.10 fixed ?
- vendor:f5 big-ip automation toolchain affected >= 16.1.0, <= 16.1.4 fixed ?
- vendor:f5 big-ip automation toolchain affected >= 17.1.0, <= 17.1.1 fixed ?

## Fix

Apply the mitigations from the vendor (F5) instructions, or stop using the product if mitigations are unavailable, as CISA requires.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-46748
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-46748

## From the sources

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_