CVE-2015-8611

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-12 · updated 2026-06-17
Weakness: CWE-255

Description

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.

Affected products

F5 BIG-IP APM: 12.0.0
BIG-IP: 12.0.0
F5 Big-Ip Analytics: 12.0.0
F5 Networks, Inc. BIG-IP (AAM): 12.0.0
BIG-IP ASM: 12.0.0
F5 BIG-IP DNS: 12.0.0
F5 Big-Ip Link Controller: 12.0.0
F5 BIG-IP (LTM): 12.0.0
F5 Networks, Inc. BIG-IP (PEM): 12.0.0

References

http://www.securitytracker.com/id/1034629
https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html
http://www.securitytracker.com/id/1034629
https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html

Get alerted when CVE-2015-8611 or the next vulnerability affects your stack