Every CVESearch/Get API key

CVE-2012-1493

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1...

7.8 HighPublic exploit

CVE-2012-1493 is a high vulnerability (CVSS 7.8) in F5 Enterprise Manager, published July 9, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.0%, the 99th percentile. No source names a fixed version.

Severity
7.8 HighCVSS 2.0, NVD
Exploit chance
63.0%EPSS, 99th percentile
Exploitation
None known4 public exploits
Fixed in
No fix listedNo source names one

Description

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Exploit likelihood

63.0%Down 13.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Show 13 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBF5 BIG-IP - Authentication Bypass (PoC)2012-06-11
MetasploitF5 BIG-IP SSH Private Key Exposure2012-06-11
Exploit-DBF5 BIG-IP - Authentication Bypass2012-06-12
Exploit-DBF5 BIG-IP - SSH Private Key Exposure (Metasploit)2012-06-13

What each source reports

NVD Score used7.8

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Record
CVE-2012-1493
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:C/I:N/A:N
Weakness
CWE-255
Updated
2026-11-02
CVE ListNo score

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Record
CVE-2012-1493
Updated
2026-11-02
EUVDEUVD-2012-1511No score

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Record
EUVD-2012-1511
Updated
2026-11-03
GitHub AdvisoriesGHSA-9xc6-7wh2-7r7rNo score

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1...

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Record
GHSA-9xc6-7wh2-7r7r
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open