What’s Vulnerable › Vulnerabilities

CVE-2023-28724: NGINX Management Suite vulnerability

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-03 · updated 2026-06-17
• Weakness: CWE-276

Description

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 NGINX API Connectivity Manager: from 1.0.0 before 1.5.0 — fixed in 1.5.0
• F5 NGINX Instance Manager: from 2.0.0 before 2.9.0 — fixed in 2.9.0
• F5 NGINX Security Monitoring: from 1.0.0 before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: F5 NGINX API Connectivity Manager 1.5.0; F5 NGINX Instance Manager 2.9.0; F5 NGINX Security Monitoring 1.3.0. Check the vendor advisory for mitigations.

References

• https://my.f5.com/manage/s/article/K000133233
• https://security.netapp.com/advisory/ntap-20230609-0006/
• https://my.f5.com/manage/s/article/K000133233
• https://security.netapp.com/advisory/ntap-20230609-0006/

Get alerted when CVE-2023-28724 or the next vulnerability affects your stack