{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3af5big-ip_carrier-grade_nat/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_fraud_protection_services:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-46747"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-FU2X2000-CVE-2023-46747\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["BIG-IP Access Policy Manager (\u003c= 13.1.5, 14.1.5, 15.1.10, 16.1.4, 17.1.1)"],"_cs_severities":["critical"],"_cs_tags":["f5","big-ip","tmui","authentication-bypass","cve-2023-46747","webserver"],"_cs_type":"threat","_cs_vendors":["F5"],"content_html":"\u003cp\u003eCVE-2023-46747 is a critical authentication bypass vulnerability affecting F5 BIG-IP's Traffic Management User Interface (TMUI). This vulnerability allows a remote attacker to bypass authentication and gain unauthorized access to the BIG-IP system. Successful exploitation can lead to remote code execution, data theft, and complete system compromise. The vulnerability exists because of an undisclosed flaw in the TMUI that allows specially crafted HTTP requests to bypass authentication checks. Praetorian reported active exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable F5 BIG-IP instance with TMUI enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted HTTP PATCH request to the \u003ccode\u003e/mgmt/tm/auth/user/\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request bypasses authentication checks due to the vulnerability in TMUI.\u003c/li\u003e\n\u003cli\u003eThe system incorrectly grants the attacker access as an authenticated user.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the unauthorized access to execute arbitrary commands on the system.\u003c/li\u003e\n\u003cli\u003eThe attacker may install a web shell or other persistent backdoor for continued access.\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges to gain root access.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates sensitive data, disrupts services, or performs other malicious activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-46747 can have severe consequences. An attacker can gain complete control over the F5 BIG-IP system, leading to disruption of critical services, data breaches, and financial losses. Given that F5 BIG-IP devices are often used in large enterprise networks, a successful attack could have a widespread impact, affecting numerous users and applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eF5 TMUI Authentication Bypass\u003c/code\u003e to your SIEM and tune for your environment, focusing on web server logs.\u003c/li\u003e\n\u003cli\u003eImmediately patch CVE-2023-46747 on all affected F5 BIG-IP systems (reference: F5 security advisory).\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for PATCH requests to the \u003ccode\u003e/mgmt/tm/auth/user/\u003c/code\u003e URI path, as highlighted in the Sigma rule.\u003c/li\u003e\n\u003cli\u003eInspect web traffic for unusual HTTP user agents associated with CVE-2023-46747 exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T19:47:36Z","date_published":"2024-01-26T18:23:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-f5-tmui-auth-bypass/","summary":"Exploitation of CVE-2023-46747, an authentication bypass vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI), allows unauthorized access and potentially leads to remote code execution.","title":"F5 BIG-IP TMUI Authentication Bypass via CVE-2023-46747","url":"https://feed.craftedsignal.io/briefs/2024-01-f5-tmui-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:f5:big-Ip_carrier-Grade_nat:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}