CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
CVE-2023-46747 is a critical vulnerability (CVSS 9.8) in F5 Big-ip, published October 26, 2023. CISA lists it as known to be exploited, since October 31, 2023. EUVD reports exploitation since October 31, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.7%, the 99th percentile. No source names a fixed version.
- Severity
- 9.8 CriticalCVSS 3.1, CVE List
- Exploit chance
- 96.7%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- f5 big-ip
- f5 big-ip configuration utility
- f5 big-ip access policy manager
- f5 big-ip advanced firewall manager
- f5 big-ip advanced web application firewall
- f5 big-ip analytics
- f5 big-ip application acceleration manager
- f5 big-ip application security manager
- f5 big-ip application visibility and reporting
- f5 big-ip automation toolchain
- f5 big-ip carrier-grade nat
- f5 big-ip container ingress services
Show 10 moreShow less
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | F5 BIG-IP TMUI AJP Smuggling RCE | 2023-10-26 |
| PoC in GitHub | W01fh4cker/CVE-2023-46747-RCE | 2023-11-01 |
| PoC in GitHub | fu2x2000/CVE-2023-46747 | 2023-11-01 |
| PoC in GitHub | maniak-academy/Mitigate-CVE-2023-46747 | 2023-11-01 |
| PoC in GitHub | nvansluis/test_cve-2023-46747 | 2023-11-02 |
| PoC in GitHub | RevoltSecurities/CVE-2023-46747 | 2023-11-03 |
| PoC in GitHub | vidura2/cve-2023-46747 | 2024-02-11 |
| PoC in GitHub | cediegreyhat/BigFinger | 2025-07-04 |
| PoC in GitHub | Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit | 2025-12-03 |
| Nuclei | F5 BIG-IP - Unauthenticated RCE via AJP Smuggling |
What each source reports
CVE List Score used
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
CVE-2023-46747- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2023-50916
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
EUVD-2023-50916- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pq6p-fc96-wc5w
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with...
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
GHSA-pq6p-fc96-wc5w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288, CWE-306
- Updated
- 2026-11-02
CISA KEVNo score
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
- Record
CVE-2023-46747- Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Record
CVE-2023-46747- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288, CWE-306
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
my.f5.com/manage/s/article/K000137353
packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html
secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747
nvd.nist.gov/vuln/detail/CVE-2023-46747
github.com/advisories/GHSA-pq6p-fc96-wc5w