NCSC | Beveiligingsadviezen
Bekijk RSS-feed

Beveiligingsadviezen

Download

Beveilingsadvies; NCSC-2026-0162 [1.0.0]

Beveiligingsadvies
NCSC-2026-0162 [1.0.0]
Publicatie
15-05-2026 14:07 (Europe/Amsterdam)
Prioriteit
Normaal
Betreft
Kwetsbaarheden verholpen in F5 BIG-IP en BIG-IQ producten

Kenmerken

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • Path Traversal: '.../...//'
  • Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • Stack-based Buffer Overflow
  • Incorrect Calculation of Buffer Size
  • Exposure of Sensitive Information to an Unauthorized Actor
  • Execution with Unnecessary Privileges
  • Unchecked Return Value
  • Incorrect Privilege Assignment
  • Privilege Defined With Unsafe Actions
  • Least Privilege Violation
  • Cleartext Storage of Sensitive Information
  • Cross-Site Request Forgery (CSRF)
  • Use After Free
  • Unprotected Alternate Channel
  • NULL Pointer Dereference
  • Deserialization of Untrusted Data
  • Insertion of Sensitive Information into Log File
  • Files or Directories Accessible to External Parties
  • Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  • Incorrect Use of Privileged APIs
  • Incorrect Permission Assignment for Critical Resource
  • Allocation of Resources Without Limits or Throttling
  • Missing Release of Resource after Effective Lifetime
  • Access of Uninitialized Pointer
  • Loop with Unreachable Exit Condition ('Infinite Loop')

Omschrijving

F5 heeft meerdere kwetsbaarheden verholpen in de BIG-IP en BIG-IQ productlijnen, inclusief componenten zoals iControl REST, iControl SOAP, TMOS Shell, Traffic Management Microkernel (TMM), Configuration utility, Advanced WAF, ASM, PEM, DNS, Access Policy Manager (APM) en SSL Orchestrator.

De kwetsbaarheden betreffen onder andere directory traversal, ongeautoriseerde bestandswijzigingen, blootstelling van gevoelige SSH-wachtwoorden in API-responses en auditlogs, privilege escalatie via onjuiste permissie-toewijzingen, remote command injection, cross-account informatielekken, en onverwachte procesafsluitingen (zoals van TMM, httpd, apmd en bd processen) door specifieke configuraties of ongedocumenteerde verkeerspatronen.

Exploitatie vereist doorgaans geauthenticeerde toegang met rollen variërend van Manager, Resource Administrator tot Administrator, afhankelijk van de kwetsbaarheid. Sommige kwetsbaarheden maken het mogelijk om configuratieobjecten te wijzigen, wat kan leiden tot het uitvoeren van willekeurige commando's met verhoogde privileges.

Andere kwetsbaarheden betreffen het lekken van gevoelige informatie via onjuiste toegangscontrole of onvoldoende validatie binnen managementinterfaces. Diverse kwetsbaarheden zijn specifiek voor Appliance mode of bepaalde configuratieprofielen zoals SSL, HTTP/2, SIP, LDAP authenticatie, en SNMP configuraties. De impact omvat onder meer het omzeilen van beveiligingscontroles, het escaleren van privileges, het lekken van gevoelige gegevens, en het verstoren van de beschikbaarheid en stabiliteit van netwerk- en applicatiebeheercomponenten. Niet-ondersteunde softwareversies zijn in de meeste gevallen niet geëvalueerd voor deze kwetsbaarheden.

Oplossingen

F5 heeft updates uitgebracht om de kwetsbaarheden in de BIG-IP en BIG-IQ producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Referenties

CVE's

Producten

F5
AI Gateway
BIG-IP
BIG-IP APM
BIG-IP Advanced WAF/ASM
BIG-IP Advanced WAF/ASM and BIG-IP DDoS Hybrid Defender
BIG-IP DNS
BIG-IP Next CNF
BIG-IP Next SPK
BIG-IP Next for Kubernetes
BIG-IP PEM
BIG-IP SSL Orchestrator
BIG-IP tenants on BX110 blades on VELOS
BIG-IP tenants on BX520 blades on VELOS
BIG-IP tenants on all other rSeries systems
BIG-IP tenants on r10000 rSeries
BIG-IP tenants on r12000 rSeries
BIG-IP tenants on r5000 rSeries
BIG-IQ
BIG-IQ Centralized Management
Distributed Cloud (all services)
NGINX (all products)
OS-A
OS-C
SSL Orchestrator
Silverline (all services)
Traffix SDC

Disclaimer

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.