CVE-2012-1493: F5 BIG-IP and Enterprise Manager shared SSH private key allows unauthorized logins

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityA publicly available Metasploit module and very high EPSS score make exploitation likely, and successful SSH login grants full management access to the device.

What it is

F5 BIG-IP appliances and Enterprise Manager shipped with a single SSH private key reused across different customers' installations, and access to that key was not properly restricted. Because the key is shared and reachable, anyone who obtains it can authenticate to affected devices over SSH. This undermines the assumption that SSH access is per-device and per-customer.

Impact

An attacker with the shared key gains remote SSH login to affected appliances, exposing configuration and management access. The CVSS vector rates confidentiality impact as complete, with no integrity or availability impact stated.

Attack surface

Reachable over the network via SSH using the PubkeyAuthentication option; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required to attempt the login. The description does not state whether the key is exposed through a separate channel or only via the appliance itself.

Exploitation

Not listed in CISA KEV, but EPSS is 0.63078 (99.166th percentile), and references include a Metasploit module tagged Exploit and Patch, indicating public exploit tooling exists. No ransomware usage is documented.

What to do

• Apply the F5 fixes for the affected branches: 9.4.8-HF5, 10.2.4, 11.0.0-HF2, 11.1.0-HF3, and Enterprise Manager 2.1.0-HF2, 2.2.0-HF1, 2.3.0-HF3.
• Replace the shared SSH host key material on affected devices and regenerate keys unique per installation.
• Restrict SSH management access to trusted networks and disable PubkeyAuthentication where it is not required.
• Rotate any credentials or trust relationships that relied on the shared key, and review SSH authorized_keys on affected systems.

Detection

• Audit SSH authorized_keys and host key fingerprints on BIG-IP and Enterprise Manager devices for the known shared key.
• Monitor SSH authentication logs for successful logins using the affected key from unexpected source addresses.
• Alert on SSH logins to management interfaces from outside approved administrative networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.