CVE-2023-28742

Published: May 3, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (5)

Products: F5: Big Ip Domain Name System

1 product

Big Ip Domain Name System

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Domain Name System	From 13.1.0 to 13.1.5
F5 Big Ip Domain Name System	From 14.1.0 to 14.1.5.4
F5 Big Ip Domain Name System	From 15.1.0 to 15.1.8.2
F5 Big Ip Domain Name System	From 16.1.0 to 16.1.3.4
F5 Big Ip Domain Name System	From 17.0.0 to 17.1.0.1

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://my.f5.com/manage/s/article/K000132972

Source: f5sirt@f5.com

Vendor Advisory

https://my.f5.com/manage/s/article/K000132972

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.