CVE-2016-5736

High

Published: 19/08/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM and other components before specified versions allows remote attackers to establish IKE Phase 1 negotiations. This may lead to brute-force attacks against Phase 2 negotiations.

Risk Assessment

Organizations may be exposed to attacks that could compromise the security of their systems. Improper configuration may allow unauthorized access to sensitive data.

Recommendation

It is recommended to update to the latest software versions that mitigate this vulnerability and review the IPsec IKE configuration to disable anonymous peer configuration.

Other vulnerabilities in F5 BIG-IP LTM, Analytics, APM, ASM, Link Controller, AAM, AFM, PEM, DNS, Edge Gateway, WebAccelerator, WOM, GTM, PSM

CVE-2016-5022Critical
A vulnerability in F5 BIG-IP that affects various software versions allows remote attackers to cause a denial of service by restarting the traffic management microkernel when packet filtering is enabled on virtual servers.

Original NVD description (English source)

The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF2; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF2; BIG-IP DNS 12.x before 12.0.0 HF2; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.1 before HF16; BIG-IP GTM 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1; and BIG-IP PSM 11.4.0 through 11.4.1 improperly enables the anonymous IPsec IKE peer configuration object, which allows remote attackers to establish an IKE Phase 1 negotiation and possibly conduct brute-force attacks against Phase 2 negotiations via unspecified vectors.