CVE-2019-6684

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-23 · updated 2026-06-17

Description

On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing (vCMP) may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades. An attacker can leverage the fragmented broadcast IP packets to perform any type of fragmentation-based attack.

Affected products

F5 BIG-IP APM: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
BIG-IP: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Big-Ip Analytics: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Networks, Inc. BIG-IP (AAM): from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
BIG-IP ASM: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 BIG-IP DNS: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Big-Ip Fraud Protection Service: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Big-Ip Global Traffic Manager: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Big-Ip Link Controller: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 BIG-IP (LTM): from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0
F5 Networks, Inc. BIG-IP (PEM): from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 before 13.1.3.2; from 14.0.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 13.1.3.2, 14.1.2.3, 15.1.0; BIG-IP 13.1.3.2, 14.1.2.3, 15.1.0; F5 Big-Ip Analytics 13.1.3.2, 14.1.2.3, 15.1.0; F5 Networks, Inc. BIG-IP (AAM) 13.1.3.2, 14.1.2.3, 15.1.0; BIG-IP ASM 13.1.3.2, 14.1.2.3, 15.1.0; F5 BIG-IP DNS 13.1.3.2, 14.1.2.3, 15.1.0; F5 Big-Ip Fraud Protection Service 13.1.3.2, 14.1.2.3, 15.1.0; F5 Big-Ip Global Traffic Manager 13.1.3.2, 14.1.2.3, 15.1.0; F5 Big-Ip Link Controller 13.1.3.2, 14.1.2.3, 15.1.0; F5 BIG-IP (LTM) 13.1.3.2, 14.1.2.3, 15.1.0; F5 Networks, Inc. BIG-IP (PEM) 13.1.3.2, 14.1.2.3, 15.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6684 or the next vulnerability affects your stack