On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 us

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager11.2.1 and later · up to 11.6.3 inclusive
• f5 big-ip access policy manager12.1.0 and later · up to 12.1.3 inclusive
• f5 big-ip access policy manager13.0.0 and later · up to 13.1.1 inclusive
• f5 big-ip access policy manager14.0.0
• f5 big-ip advanced firewall manager11.2.1 and later · up to 11.6.3 inclusive
• f5 big-ip advanced firewall manager12.1.0 and later · up to 12.1.3 inclusive
• f5 big-ip advanced firewall manager13.0.0 and later · up to 13.1.1 inclusive
• f5 big-ip advanced firewall manager14.0.0
• f5 big-ip analytics11.2.1 and later · up to 11.6.3 inclusive
• f5 big-ip analytics12.1.0 and later · up to 12.1.3 inclusive
• f5 big-ip analytics13.0.0 and later · up to 13.1.1 inclusive
• f5 big-ip analytics14.0.0
• f5 big-ip application acceleration manager11.2.1 and later · up to 11.6.3 inclusive
• f5 big-ip application acceleration manager12.1.0 and later · up to 12.1.3 inclusive
• f5 big-ip application acceleration manager13.0.0 and later · up to 13.1.1 inclusive
• f5 big-ip application acceleration manager14.0.0
• f5 big-ip application security manager11.2.1 and later · up to 11.6.3 inclusive
• f5 big-ip application security manager12.1.0 and later · up to 12.1.3 inclusive
• f5 big-ip application security manager13.0.0 and later · up to 13.1.1 inclusive
• f5 big-ip application security manager14.0.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• F5 Networks, Inc. BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow

  • BIG-IP 14.0.x, 13.x, 12.x, 11.x, EM 3.1.1, BIG-IQ 6.x, 5.x, 4.x, iWorkflow 2.xaffected

Other highest-scoring records for the same primary product.

• CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior KEV
  99Now
• CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 KEV
  99Now
• CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteKEV
  99Now
• CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityKEV
  98Now
• CVE-2021-22991On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,KEV
  87Now
• CVE-2026-94127BIG-IP APM OAuth vulnerabilityKEV
  68This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.