CVE-2021-23024

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-10 · updated 2026-06-17

Description

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 BIG-IQ: from 6.0.0 through 6.1.0; from 7.0.0 through 7.1.0; from 8.0.0 before 8.0.0.1 — fixed in 8.0.0.1

How to fix

Upgrade to a fixed version: F5 BIG-IQ 8.0.0.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html
https://support.f5.com/csp/article/K06024431
http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html
https://support.f5.com/csp/article/K06024431

Get alerted when CVE-2021-23024 or the next vulnerability affects your stack