What’s Vulnerable › Vulnerabilities

CVE-2014-2927

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-10-15 · updated 2026-06-17
• Weakness: CWE-287

Description

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

Affected products

• F5 Arx: 6.0.0, 6.1.0, 6.1.1, 6.2.0, 6.3.0, 6.4.0
• F5 BIG-IP APM: 10.1.0, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4 (+10)
• BIG-IP: 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.6.0
• F5 Big-Ip Analytics: 11.0.0, 11.1.0, 11.2.0, 11.2.1, 11.3.0, 11.4.0 (+4)
• F5 Networks, Inc. BIG-IP (AAM): 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.6.0
• BIG-IP ASM: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+12)
• F5 Big-Ip Edge Gateway: 10.1.0, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4 (+5)
• F5 Big-Ip Global Traffic Manager: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+12)
• F5 Big-Ip Link Controller: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+12)
• F5 BIG-IP (LTM): 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+12)
• F5 Networks, Inc. BIG-IP (PEM): 11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.6.0
• F5 Big-Ip Protocol Security Module: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+9)
• F5 Big-Ip Wan Optimization Manager: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+7)
• F5 Big-Ip Webaccelerator: 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.2.2 (+7)
• F5 Big-Iq Cloud: 4.0.0, 4.1.0, 4.2.0, 4.3.0
• F5 Big-Iq Device: 4.2.0, 4.3.0
• F5 Big-Iq Security: 4.0.0, 4.1.0, 4.2.0, 4.3.0
• F5 Networks, Inc. Enterprise Manager: 2.1.0, 2.2.0, 2.3.0, 3.0.0, 3.1.0, 3.1.1
• F5 Firepass: 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.1.0, 7.0.0

References

• http://www.exploit-db.com/exploits/34465
• http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf
• https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html
• http://www.exploit-db.com/exploits/34465
• http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf
• https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html

Get alerted when CVE-2014-2927 or the next vulnerability affects your stack