[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTinV6KRMe1YP-nho7nNYHp4A-AO8R-P5z6_kIQGPGV0":3,"g5a-family:f5\u002Fbig-iq_centralized_management":174,"g5a-ex:f5\u002Fbig-iq_centralized_management@*":175},{"success":4,"data":5},true,{"product":6,"versions":59,"topVulnerabilitiesByEpss":78,"kevVulnerabilities":141,"seoMetadata":152,"meta":171},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":58},"f5","big-iq_centralized_management",18,76,2,"2024-10-16",[14,18,22,24,26,28,31,33,35,37,40,42,45,47,49,52,54,56],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},"4.6.0",13,1,{"version":19,"cve_count":20,"kev_count":20,"has_kev":21},"5.0.0",0,false,{"version":23,"cve_count":20,"kev_count":20,"has_kev":21},"5.1.0",{"version":25,"cve_count":20,"kev_count":20,"has_kev":21},"5.2.0",{"version":27,"cve_count":20,"kev_count":20,"has_kev":21},"5.3.0",{"version":29,"cve_count":30,"kev_count":20,"has_kev":21},"5.4.0",3,{"version":32,"cve_count":17,"kev_count":20,"has_kev":21},"6.0.0",{"version":34,"cve_count":20,"kev_count":20,"has_kev":21},"6.0.1",{"version":36,"cve_count":20,"kev_count":20,"has_kev":21},"6.1.0",{"version":38,"cve_count":39,"kev_count":20,"has_kev":21},"7.0.0",17,{"version":41,"cve_count":20,"kev_count":20,"has_kev":21},"7.0.0.2",{"version":43,"cve_count":44,"kev_count":20,"has_kev":21},"7.1.0",6,{"version":46,"cve_count":20,"kev_count":20,"has_kev":21},"7.1.0.1",{"version":48,"cve_count":20,"kev_count":20,"has_kev":21},"7.1.0.3",{"version":50,"cve_count":51,"kev_count":20,"has_kev":21},"8.0.0",4,{"version":53,"cve_count":30,"kev_count":20,"has_kev":21},"8.1.0",{"version":55,"cve_count":30,"kev_count":20,"has_kev":21},"8.2.0",{"version":57,"cve_count":20,"kev_count":20,"has_kev":21},"8.3.0","Big-iq Centralized Management by F5 is a technology product with 18 tracked versions and 76 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},{"version":19,"cve_count":20,"kev_count":20,"has_kev":21},{"version":23,"cve_count":20,"kev_count":20,"has_kev":21},{"version":25,"cve_count":20,"kev_count":20,"has_kev":21},{"version":27,"cve_count":20,"kev_count":20,"has_kev":21},{"version":29,"cve_count":30,"kev_count":20,"has_kev":21},{"version":32,"cve_count":17,"kev_count":20,"has_kev":21},{"version":34,"cve_count":20,"kev_count":20,"has_kev":21},{"version":36,"cve_count":20,"kev_count":20,"has_kev":21},{"version":38,"cve_count":39,"kev_count":20,"has_kev":21},{"version":41,"cve_count":20,"kev_count":20,"has_kev":21},{"version":43,"cve_count":44,"kev_count":20,"has_kev":21},{"version":46,"cve_count":20,"kev_count":20,"has_kev":21},{"version":48,"cve_count":20,"kev_count":20,"has_kev":21},{"version":50,"cve_count":51,"kev_count":20,"has_kev":21},{"version":53,"cve_count":30,"kev_count":20,"has_kev":21},{"version":55,"cve_count":30,"kev_count":20,"has_kev":21},{"version":57,"cve_count":20,"kev_count":20,"has_kev":21},[79,87,94,100,105,112,118,125,130,135],{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":84,"severity":85,"isKev":4,"epssScore":86},"CVE-2021-22986","On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.","2021-03-31",9.8,"v3.1","Critical",0.99898,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":84,"severity":92,"isKev":21,"epssScore":93},"CVE-2022-41622","In all versions, \n\nBIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n","2022-12-07",8.8,"High",0.92436,{"cveId":95,"description":96,"publishedDate":97,"cvssScore":98,"cvssVersion":84,"severity":92,"isKev":21,"epssScore":99},"CVE-2019-11479","Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.","2019-06-19",7.5,0.9166,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":98,"cvssVersion":84,"severity":92,"isKev":21,"epssScore":104},"CVE-2002-20001","The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.","2021-11-11",0.24639,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":84,"severity":110,"isKev":4,"epssScore":111},"CVE-2014-0196","The n_tty_write function in drivers\u002Ftty\u002Fn_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO & !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.","2014-05-07",5.5,"Medium",0.22475,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":116,"cvssVersion":84,"severity":110,"isKev":21,"epssScore":117},"CVE-2019-1559","If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).","2019-02-27",5.9,0.17139,{"cveId":119,"description":120,"publishedDate":121,"cvssScore":122,"cvssVersion":123,"severity":92,"isKev":21,"epssScore":124},"CVE-2015-4047","racoon\u002Fgssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.","2015-05-29",7.8,"v2",0.0973,{"cveId":126,"description":127,"publishedDate":128,"cvssScore":122,"cvssVersion":123,"severity":92,"isKev":21,"epssScore":129},"CVE-2014-0101","The sctp_sf_do_5_1D_ce function in net\u002Fsctp\u002Fsm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.","2014-03-11",0.07179,{"cveId":131,"description":132,"publishedDate":133,"cvssScore":98,"cvssVersion":84,"severity":92,"isKev":21,"epssScore":134},"CVE-2018-5743","By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.","2019-10-09",0.06457,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":139,"cvssVersion":84,"severity":92,"isKev":21,"epssScore":140},"CVE-2021-23024","On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","2021-06-10",7.2,0.05346,[142,147],{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"severity":110,"isKev":4,"epssScore":111,"cisaVulnName":143,"cisaDateAdded":144,"cisaShortDescription":145,"cisaRequiredAction":146},"Linux Kernel Race Condition Vulnerability","2023-05-12","Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.","The impacted product is end-of-life and should be disconnected if still in use.",{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"severity":85,"isKev":4,"epssScore":86,"cisaVulnName":148,"cisaDateAdded":149,"cisaShortDescription":150,"cisaRequiredAction":151},"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","2021-11-03","F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.","Apply updates per vendor instructions.",{"title":153,"metaDescription":154,"keywords":155,"structuredData":156},"Big-iq Centralized Management by F5 - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Big-iq Centralized Management by F5 covering 18 versions with 76 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Big-iq Centralized Management vulnerabilities, Big-iq Centralized Management security, Big-iq Centralized Management CVE, F5 Big-iq Centralized Management, Big-iq Centralized Management threat intelligence, F5 security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Big-iq Centralized Management KEV, Big-iq Centralized Management exploited vulnerabilities",{"@context":157,"@type":158,"name":159,"description":154,"url":160,"manufacturer":161,"applicationCategory":165,"softwareVersion":166,"mainEntity":167},"https:\u002F\u002Fschema.org","SoftwareApplication","Big-iq Centralized Management","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Ff5\u002Fbig-iq_centralized_management",{"@type":162,"name":163,"url":164},"Organization","F5","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ff5","Security Software","18 versions tracked",{"@type":168,"name":169,"description":170,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Big-iq Centralized Management Security Vulnerabilities","Security vulnerabilities affecting Big-iq Centralized Management by F5",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":172,"apiVersion":173},"2026-10-17T14:58:43.741Z","3.0",[],{"rows":176,"total":11,"capped":21,"failed":20},[177,181],{"cveId":106,"name":143,"severity":110,"cvss":109,"added":144,"epss":111,"published":178,"ranges":179,"checked":4,"hits":180,"covers":21},"2014-05-07T10:55:04.337",[15],[],{"cveId":80,"name":148,"severity":85,"cvss":83,"added":149,"epss":86,"published":182,"ranges":183,"checked":4,"hits":187,"covers":21},"2021-03-31T15:15:15.153",[184,185,186],"6.0.0 to before 6.1.0","7.0.0 to before 7.0.0.2","7.1.0 to before 7.1.0.3",[]]