CVE-2016-7469

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-09 · updated 2026-06-17
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.

Affected products

F5 BIG-IP APM: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
BIG-IP: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
F5 Big-Ip Analytics: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
F5 Networks, Inc. BIG-IP (AAM): 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3 (+7)
BIG-IP ASM: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
F5 BIG-IP DNS: 12.0.0, 12.1.0, 12.1.1, 12.1.2
F5 Big-Ip Edge Gateway: 11.2.1
F5 Big-Ip Global Traffic Manager: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+4)
F5 Big-Ip Link Controller: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
F5 BIG-IP (LTM): 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+8)
F5 Networks, Inc. BIG-IP (PEM): 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3 (+7)
F5 Big-Ip Protocol Security Module: 11.4.0, 11.4.1
F5 Big-Ip Wan Optimization Manager: 11.2.1
F5 Big-Ip Webaccelerator: 11.2.1
F5 Big-Ip Websafe: 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1, 12.1.2
F5 Networks, Inc. Enterprise Manager: 3.1.1

References

Get alerted when CVE-2016-7469 or the next vulnerability affects your stack