Skip to content
CVE PROGRAM SOURCE RECORD6.7 Medium

CVE-2024-21782

BIG-IP and BIG-IQ secure copy vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
f5

Description

BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

F5 BIG-IP

Default version status: unknown

  • 17.1.0 to < 17.1.1affected
  • 16.1.0 to < 16.1.4affected
  • 15.1.0 to < 15.1.9affected

F5 BIG-IQ

Default version status: unknown

  • 8.0.0 to < *affected

References