Strix
26.1K

CVE-2014-2928

UnknownEPSS 39.05%

Last modified

CVE-2014-2928 is a vulnerability of currently unknown severity. The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.. EPSS estimates a 39.05% chance of exploitation in the next 30 days.

Description

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.

Metrics

EPSS Probability
39.05%

98.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
F5Big-Ip Webaccelerator9.4.0
F5Big-Ip Webaccelerator9.4.1
F5Big-Ip Webaccelerator9.4.2
F5Big-Ip Webaccelerator9.4.3
F5Big-Ip Webaccelerator9.4.4
F5Big-Ip Webaccelerator9.4.5
F5Big-Ip Webaccelerator9.4.6
F5Big-Ip Webaccelerator9.4.7
F5Big-Ip Webaccelerator9.4.8
F5Big-Ip Webaccelerator10.0.0
F5Big-Ip Webaccelerator10.0.1
F5Big-Ip Webaccelerator10.1.0
F5Big-Ip Webaccelerator10.2.0
F5Big-Ip Webaccelerator10.2.1
F5Big-Ip Webaccelerator10.2.2
F5Big-Ip Webaccelerator10.2.3
F5Big-Ip Webaccelerator10.2.4
F5Big-Ip Webaccelerator11.0.0
F5Big-Ip Webaccelerator11.1.0
F5Big-Ip Webaccelerator11.2.0
F5Big-Ip Webaccelerator11.2.1
F5Big-Ip Webaccelerator11.3.0
F5Big-Ip Local Traffic Manager10.0.0
F5Big-Ip Local Traffic Manager10.0.1
F5Big-Ip Local Traffic Manager10.1.0
F5Big-Ip Local Traffic Manager10.2.0
F5Big-Ip Local Traffic Manager10.2.1
F5Big-Ip Local Traffic Manager10.2.2
F5Big-Ip Local Traffic Manager11.0.0
F5Big-Ip Protocol Security Module9.4.5
F5Big-Ip Protocol Security Module9.4.6
F5Big-Ip Protocol Security Module9.4.7
F5Big-Ip Protocol Security Module9.4.8
F5Big-Ip Protocol Security Module10.0.0
F5Big-Ip Protocol Security Module10.0.1
F5Big-Ip Protocol Security Module10.1.0
F5Big-Ip Protocol Security Module10.2.0
F5Big-Ip Protocol Security Module10.2.1
F5Big-Ip Protocol Security Module10.2.2
F5Big-Ip Protocol Security Module10.2.3
F5Big-Ip Protocol Security Module10.2.4
F5Big-Ip Protocol Security Module11.0.0
F5Big-Ip Protocol Security Module11.1.0
F5Big-Ip Protocol Security Module11.2.0
F5Big-Ip Protocol Security Module11.2.1
F5Big-Ip Protocol Security Module11.3.0
F5Big-Ip Protocol Security Module11.4.0
F5Big-Ip Protocol Security Module11.4.1
F5Big-Ip Link Controller10.0.0
F5Big-Ip Link Controller10.0.1

Showing 50 of 86 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-2928?
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
How severe is CVE-2014-2928?
Severity scoring for CVE-2014-2928 is pending analysis. The EPSS model estimates a 39.05% probability of exploitation in the next 30 days.
How do I fix CVE-2014-2928?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2014

View all 2014CVEs →

Are you affected by CVE-2014-2928?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST