CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
CVE-2023-46747- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2023-50916
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
EUVD-2023-50916- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pq6p-fc96-wc5w
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with...
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
GHSA-pq6p-fc96-wc5w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288, CWE-306
- Updated
- 2026-11-02
CISA KEV No score
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
- Record
CVE-2023-46747- Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
CVE-2023-46747- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288, CWE-306
- Updated
- 2026-11-02
Affected products
- f5 big-ip
- f5 big-ip configuration utility
- f5 big-ip access policy manager
- f5 big-ip advanced firewall manager
- f5 big-ip advanced web application firewall
- f5 big-ip analytics
- f5 big-ip application acceleration manager
- f5 big-ip application security manager
- f5 big-ip application visibility and reporting
- f5 big-ip automation toolchain
- f5 big-ip carrier-grade nat
- f5 big-ip container ingress services
Show 10 moreShow less
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | F5 BIG-IP TMUI AJP Smuggling RCE | 2023-10-26 |
| PoC in GitHub | W01fh4cker/CVE-2023-46747-RCE | 2023-11-01 |
| PoC in GitHub | fu2x2000/CVE-2023-46747 | 2023-11-01 |
| PoC in GitHub | maniak-academy/Mitigate-CVE-2023-46747 | 2023-11-01 |
| PoC in GitHub | nvansluis/test_cve-2023-46747 | 2023-11-02 |
| PoC in GitHub | RevoltSecurities/CVE-2023-46747 | 2023-11-03 |
| PoC in GitHub | vidura2/cve-2023-46747 | 2024-02-11 |
| PoC in GitHub | cediegreyhat/BigFinger | 2025-07-04 |
| PoC in GitHub | Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit | 2025-12-03 |
| Nuclei | F5 BIG-IP - Unauthenticated RCE via AJP Smuggling |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46747 is a critical vulnerability (CVSS 9.8) in F5 Big-ip, published October 26, 2023. CISA lists it as known to be exploited, since October 31, 2023. EUVD reports exploitation since October 31, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.7%, the 99th percentile. No source names a fixed version.
References
my.f5.com/manage/s/article/K000137353
packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747
nvd.nist.gov/vuln/detail/CVE-2023-46747
github.com/advisories/GHSA-pq6p-fc96-wc5w