{"id":"CVE-2023-46747","aliases":["EUVD-2023-50916","GHSA-pq6p-fc96-wc5w"],"status":"published","title":"BIG-IP Configuration utility unauthenticated remote code execution vulnerability","description":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.96715,"percentile":0.99885,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-288","CWE-306"],"published":"2023-10-26T20:04:53Z","modified":"2026-06-17T06:31:32Z","kev":{"date_added":"2023-10-31","due_date":"2023-11-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2023-10-31"},{"source":"kev","since":"2023-10-31"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747","title":"F5 BIG-IP TMUI AJP Smuggling RCE","type":"exploit","platform":"Linux,Unix","date":"2023-10-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/f5_bigip_tmui_rce_cve_2023_46747"},{"source":"pocgithub","id":"W01fh4cker/CVE-2023-46747-RCE","title":"W01fh4cker/CVE-2023-46747-RCE","date":"2023-11-01","url":"https://github.com/W01fh4cker/CVE-2023-46747-RCE"},{"source":"pocgithub","id":"fu2x2000/CVE-2023-46747","title":"fu2x2000/CVE-2023-46747","date":"2023-11-01","url":"https://github.com/fu2x2000/CVE-2023-46747"},{"source":"pocgithub","id":"maniak-academy/Mitigate-CVE-2023-46747","title":"maniak-academy/Mitigate-CVE-2023-46747","date":"2023-11-01","url":"https://github.com/maniak-academy/Mitigate-CVE-2023-46747"},{"source":"pocgithub","id":"nvansluis/test_cve-2023-46747","title":"nvansluis/test_cve-2023-46747","date":"2023-11-02","url":"https://github.com/nvansluis/test_cve-2023-46747"},{"source":"pocgithub","id":"RevoltSecurities/CVE-2023-46747","title":"RevoltSecurities/CVE-2023-46747","date":"2023-11-03","url":"https://github.com/RevoltSecurities/CVE-2023-46747"},{"source":"pocgithub","id":"vidura2/cve-2023-46747","title":"vidura2/cve-2023-46747","date":"2024-02-11","url":"https://github.com/vidura2/cve-2023-46747"},{"source":"pocgithub","id":"cediegreyhat/BigFinger","title":"cediegreyhat/BigFinger","date":"2025-07-04","url":"https://github.com/cediegreyhat/BigFinger"},{"source":"pocgithub","id":"Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit","title":"Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit","date":"2025-12-03","url":"https://github.com/Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit"},{"source":"nuclei","id":"CVE-2023-46747","title":"F5 BIG-IP - Unauthenticated RCE via AJP Smuggling","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46747.yaml"}],"products":[{"vendor":"f5","product":"big-ip"},{"vendor":"f5","product":"big-ip configuration utility"},{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_advanced_web_application_firewall"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_application_visibility_and_reporting"},{"vendor":"f5","product":"big-ip_automation_toolchain"},{"vendor":"f5","product":"big-ip_carrier-grade_nat"},{"vendor":"f5","product":"big-ip_container_ingress_services"},{"vendor":"f5","product":"big-ip_ddos_hybrid_defender"},{"vendor":"f5","product":"big-ip_domain_name_system"},{"vendor":"f5","product":"big-ip_fraud_protection_services"},{"vendor":"f5","product":"big-ip_global_traffic_manager"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_ssl_orchestrator"},{"vendor":"f5","product":"big-ip_webaccelerator"},{"vendor":"f5","product":"big-ip_websafe"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000137353","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46747"},{"url":"https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain"},{"url":"https://github.com/advisories/GHSA-pq6p-fc96-wc5w"}],"sources":{"cve":[{"id":"CVE-2023-46747","title":"BIG-IP Configuration utility unauthenticated remote code execution vulnerability","description":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T20:04:53.929Z","modified":"2025-10-21T23:05:33.431Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:35:23.645864Z"}],"euvd":[{"id":"EUVD-2023-50916","description":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T20:04:53Z","modified":"2025-10-21T23:05:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-10-31","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-pq6p-fc96-wc5w","title":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with...","description":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T21:30:22Z","modified":"2025-10-22T00:33:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2023-46747","title":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","description":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.","cwes":["CWE-288"],"kev":{"date_added":"2023-10-31","due_date":"2023-11-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-46747","description":"Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T21:15:08.097Z","modified":"2026-06-17T06:31:32.64Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T14:08:40.004465Z"}]}}