← Vulnerability feed

Vulnerability record · CVE-2021-23005 · published 31 March 2021

CVE-2021-23005: F5 big-iq centralized management vulnerability

F5 · Big Iq Centralized Management

On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

9.1 CVSS 3.1 Critical EPSS 1.00% · top 38.7%
9.1CVSS 3.1 base score, v2 6.4
1.00%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.f5.com/csp/article/K01243064 Vendor Advisory
https://support.f5.com/csp/article/K01243064 Vendor Advisory

Track CVE-2021-23005 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-22986F5 BIG-IP iControl REST unauthenticated remote command executionThe iControl REST interface on multiple F5 BIG-IP and BIG-IQ versions exposes an unauthenticated remote command execution flaw, tracked as CWE-918 se…KEVEPSS 100%analysed7.8CVE-2018-14634Linux kernel create_elf_tables() integer overflow privilege escalationAn integer overflow in the Linux kernel's create_elf_tables() function lets an unprivileged local user escalate privileges when a SUID or otherwise p…KEVEPSS 15%analysed5.5CVE-2014-0196Linux kernel n_tty_write race condition allows local privilege escalationThe n_tty_write function in the Linux kernel through 3.14.3 mishandles tty driver access in the LECHO & !OPOST case, creating a race condition betwee…KEVEPSS 22%analysed9.8CVE-2022-35728F5 big-ip access policy manager insufficient session expiration vulnerabilityIn BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BI…EPSS 0.66%9.8CVE-2020-5868F5 big-iq centralized management os command injection vulnerabilityIn BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems u…EPSS 2.2%9.8CVE-2016-5022F5 big-ip link controller improper access control vulnerabilityF5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1…EPSS 3.5%9.4CVE-2019-6665F5 big-ip application security manager vulnerabilityOn BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager…EPSS 1.1%9.1CVE-2020-5869F5 big-iq centralized management vulnerabilityIn BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data…EPSS 0.49%

Source: NIST National Vulnerability Database (record CVE-2021-23005), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.