CVE-2015-8611

Critical

Published: 12/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Versions of BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem. This may allow remote attackers to gain access to AOM via an (1) expired or (2) default password.

Risk Assessment

Organizations may be exposed to unauthorized access to the management system, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to upgrade to the latest software version to ensure proper password synchronization and minimize the risk of attacks.

Original NVD description (English source)

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.