Actively exploited in the wild
F5 BIG-IP Configuration Utility SQL Injection Vulnerability
F5 - BIG-IP Configuration Utility · Listed in the CISA KEV since 2023-10-31. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-46748
HighCVSS 8.8KEVSummary
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility. It may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.
Risk Assessment
An authenticated attacker could execute arbitrary system commands, potentially leading to full system compromise.
Recommendation
Update BIG-IP software to the version containing the fix; versions that have reached End of Technical Support are not evaluated.
Other vulnerabilities in BIG-IP Configuration utility
See all- CVE-2026-40703Medium
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. This affects software versions that have not reached End of Technical Support (EoTS).
- CVE-2023-38423Medium
CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
- CVE-2023-38138High
A reflected XSS vulnerability exists in the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Original NVD description (English source)
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated