CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

CVE-2023-46747 is an authentication bypass vulnerability in the F5 BIG-IP Configuration Utility. An unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses can send undisclosed requests that allow execution of system commands. It can be used in conjunction with CVE-2023-46748 and has been linked to known ransomware activity, making rapid response essential for any organization running BIG-IP appliances.

Defenders should treat this as a high-priority issue on internet-facing or management-network-exposed devices and confirm all details against the vendor advisory before taking action.

How it works

The flaw is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. The Configuration Utility accepts certain undisclosed requests that skip normal authentication checks. An attacker who can reach the management port or self IP addresses can therefore reach privileged functionality without credentials and execute system commands on the device.

No further exploit mechanics are described in public summaries; the exact request format and any chaining steps with CVE-2023-46748 must be confirmed against the vendor advisory. The practical result is unauthenticated remote command execution on the BIG-IP system itself.

Am I affected? How to find it in your systems

F5 BIG-IP appliances are commonly deployed as load balancers, application delivery controllers, and security gateways. The Configuration Utility is the web-based management interface that runs on the management port and on self IP addresses.

• Inventory every BIG-IP instance (hardware, virtual edition, or cloud image) and note which interfaces expose the Configuration Utility.
• Check management-port and self-IP reachability from untrusted networks; any device that answers on those addresses is in scope.
• Confirm the exact software version and Configuration Utility configuration against the vendor advisory; public summaries do not list affected version ranges.
• Review access logs for unexpected unauthenticated requests to the Configuration Utility, especially any that result in command execution or configuration changes. Correlate with authentication logs that show missing or bypassed login events.

Telemetry that shows sudden process creation, unexpected shell activity, or configuration modifications originating from the management plane should be treated as potential exploitation indicators.

How to remediate

Apply the vendor-supplied update for the F5 BIG-IP Configuration Utility as described in the official advisory. This is the primary remediation.

• Follow F5’s published upgrade or hotfix instructions exactly; do not rely on third-party summaries for version numbers or patch identifiers.
• After patching, re-verify that the Configuration Utility no longer accepts the previously vulnerable request paths.
• Restrict management-plane access to trusted administrative networks only, and disable the Configuration Utility on self IP addresses if it is not required there.
• Rotate any credentials or certificates that may have been exposed if exploitation is suspected.

CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with the following compensating controls:

• Segment the management port and self IP addresses so they are reachable only from a tightly controlled administrative jump host or out-of-band network.
• Place a web application firewall or reverse-proxy filter in front of the Configuration Utility and block any requests that match the patterns described in the vendor advisory (virtual patching).
• Temporarily disable the Configuration Utility interface on self IP addresses if operationally feasible.
• Increase monitoring and alerting for unauthenticated access attempts, unexpected command execution, and configuration changes on the BIG-IP management plane.
• If the device cannot be adequately protected, consider taking it offline or replacing it with an alternative until a patch is installed.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities on network appliances frequently lead to full device compromise and subsequent data theft or ransomware deployment. If logs or other indicators suggest this vulnerability was used against your BIG-IP systems, assume the device and any credentials or traffic it handled may have been exposed. Organizations can run a free exposure scan of their email addresses against known breach data sets to determine whether related accounts appear in public breach collections, then proceed with credential resets, forensic review, and incident-response procedures as appropriate.