CVE-2017-6131

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-23 · updated 2026-06-17
Weakness: CWE-798

Description

In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH.

Affected products

F5 BIG-IP APM: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
BIG-IP: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 Networks, Inc. BIG-IP (AAM): 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
BIG-IP ASM: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 BIG-IP DNS: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 Big-Ip Link Controller: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 BIG-IP (LTM): 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 Networks, Inc. BIG-IP (PEM): 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0
F5 Big-Ip Websafe: 12.0.0, 12.1.0, 12.1.1, 12.1.2, 13.0.0

References

Get alerted when CVE-2017-6131 or the next vulnerability affects your stack