F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747. Added to CISA KEV on 2023-10-31. CISA lists known use in ransomware campaigns.

Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV), known ransomware use

Started

Oct 31, 2023

Closed

Oct 31, 2023

CVEs

CVE-2023-46747CVE-2023-46748

• F5
• Ransomware
• CISA KEV
• SQL injection
• Auth bypass

Notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier). Grouped: same vendor/product added to KEV on the same day.