CVE-2023-45226CWE-798

BIG-IP Next SPK SSH vulnerability

High · published October 10, 2023

CVSS v3.1
7.4
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only exposed when ssh debug is enabled.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.5th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2023-10-10T12:39Z
EPSS history
Timeline
  • 10 OCT 12:39Z
    BIG-IP Next SPK SSH vulnerability
    cvelistv5