CVE-2021-23007

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-31 · updated 2026-06-17

Description

On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected products

F5 BIG-IP APM: 14.1.4, 16.0.1.1
BIG-IP: 14.1.4, 16.0.1.1
F5 Big-Ip Advanced Web Application Firewall: 14.1.4, 16.0.1.1
F5 Big-Ip Analytics: 14.1.4, 16.0.1.1
F5 Networks, Inc. BIG-IP (AAM): 14.1.4, 16.0.1.1
BIG-IP ASM: 14.1.4, 16.0.1.1
F5 Big-Ip Ddos Hybrid Defender: 14.1.4, 16.0.1.1
F5 BIG-IP DNS: 14.1.4, 16.0.1.1
F5 Big-Ip Edge Gateway: 14.1.4, 16.0.1.1
F5 Big-Ip Fraud Protection Service: 14.1.4, 16.0.1.1
F5 Big-Ip Global Traffic Manager: 14.1.4, 16.0.1.1
F5 Big-Ip Link Controller: 14.1.4, 16.0.1.1
F5 BIG-IP (LTM): 14.1.4, 16.0.1.1
F5 Networks, Inc. BIG-IP (PEM): 14.1.4, 16.0.1.1
F5 Big-Ip Ssl Orchestrator: 14.1.4, 16.0.1.1
F5 Big-Ip Webaccelerator: 14.1.4, 16.0.1.1

References

Get alerted when CVE-2021-23007 or the next vulnerability affects your stack