CVE-2021-23013

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-10 · updated 2026-06-17

Description

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 BIG-IP APM: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
BIG-IP: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Advanced Web Application Firewall: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Analytics: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Networks, Inc. BIG-IP (AAM): from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
BIG-IP ASM: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Ddos Hybrid Defender: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 BIG-IP DNS: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Fraud Protection Service: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Global Traffic Manager: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Link Controller: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 BIG-IP (LTM): from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Networks, Inc. BIG-IP (PEM): from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1
F5 Big-Ip Ssl Orchestrator: from 12.1.0 before 12.1.5.3; from 13.1.0 before 13.1.4; from 14.1.0 before 14.1.4; from 15.1.0 before 15.1.3; from 16.0.0 before 16.0.1.1 — fixed in 12.1.5.3, 13.1.4, 14.1.4, 15.1.3, 16.0.1.1

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; BIG-IP 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Advanced Web Application Firewall 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Analytics 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Networks, Inc. BIG-IP (AAM) 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; BIG-IP ASM 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Ddos Hybrid Defender 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 BIG-IP DNS 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Fraud Protection Service 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Global Traffic Manager 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 Big-Ip Link Controller 12.1.5.3, 13.1.4, 14.1.4, 15.1.3; F5 BIG-IP (LTM) 12.1.5.3, 13.1.4, 14.1.4, 15.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23013 or the next vulnerability affects your stack