Vulnerability Intelligence Report
CVE-2015-3628
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.
No Active Exploit Signals
CVSS Base Score
9.0
HIGH
EPSS Probability:68.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| f5 | big-iq_security | 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 |
| f5 | big-ip_application_acceleration_manager | 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_wan_optimization_manager | 11.3.0 |
| f5 | big-iq_adc | 4.5.0 |
| f5 | big-ip_application_security_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_global_traffic_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-iq_device | 4.2.0, 4.3.0, 4.4.0, 4.5.0 |
| f5 | big-ip_edge_gateway | 11.3.0 |
| f5 | big-ip_local_traffic_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_access_policy_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_policy_enforcement_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-iq_cloud | 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 |
| f5 | big-ip_analytics | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_protocol_security_module | 11.3.0, 11.4.0, 11.4.1 |
| f5 | big-ip_webaccelerator | 11.3.0 |
| f5 | big-ip_link_controller | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
| f5 | big-ip_enterprise_manager | 3.0.0, 3.1.0, 3.1.1 |
| f5 | big-ip_advanced_firewall_manager | 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
68.483%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2015-04-30T00:00:00 |
| Published | 2015-12-07T20:00:00 |
| Patch Date | 2015-09-09 |
| Last Updated | 2024-08-06T05:47:57 |
Community Chatter & Buzz