CVE-2023-41253

Published: Oct 10, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: f5sirt@f5.com (Secondary)

Description

When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (6)

Products: F5: Big Ip Domain Name System, Big Ip Local Traffic Manager

2 products

Big Ip Domain Name System

Big Ip Local Traffic Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Domain Name System	13.1.0 ≤ version ≤ 14.1.5
F5 Big Ip Domain Name System	15.1.0 ≤ version < 15.1.9
F5 Big Ip Domain Name System	16.1.0 ≤ version < 16.1.4
F5 Big Ip Local Traffic Manager	13.1.0 ≤ version ≤ 14.1.5
F5 Big Ip Local Traffic Manager	15.1.0 ≤ version < 15.1.9
F5 Big Ip Local Traffic Manager	16.1.0 ≤ version < 16.1.4

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://my.f5.com/manage/s/article/K98334513

Source: f5sirt@f5.com

Vendor Advisory

https://my.f5.com/manage/s/article/K98334513

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.