← Vulnerability feed

Vulnerability record · CVE-2021-23024 · published 10 June 2021

CVE-2021-23024: F5 big-iq centralized management vulnerability

F5 · Big Iq Centralized Management

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.2 CVSS 3.1 High EPSS 5.3% · top 7.7%
7.2CVSS 3.1 base score, v2 9.0
5.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html ExploitThird Party AdvisoryVDB Entry
https://support.f5.com/csp/article/K06024431 Vendor Advisory
http://packetstormsecurity.com/files/163264/F5-BIG-IQ-VE-8.0.0-2923215-Remote-Root.html ExploitThird Party AdvisoryVDB Entry
https://support.f5.com/csp/article/K06024431 Vendor Advisory

Track CVE-2021-23024 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-22986F5 BIG-IP iControl REST unauthenticated remote command executionThe iControl REST interface on multiple F5 BIG-IP and BIG-IQ versions exposes an unauthenticated remote command execution flaw, tracked as CWE-918 se…KEVEPSS 100%analysed7.8CVE-2018-14634Linux kernel create_elf_tables() integer overflow privilege escalationAn integer overflow in the Linux kernel's create_elf_tables() function lets an unprivileged local user escalate privileges when a SUID or otherwise p…KEVEPSS 15%analysed5.5CVE-2014-0196Linux kernel n_tty_write race condition allows local privilege escalationThe n_tty_write function in the Linux kernel through 3.14.3 mishandles tty driver access in the LECHO & !OPOST case, creating a race condition betwee…KEVEPSS 22%analysed9.8CVE-2022-35728F5 big-ip access policy manager insufficient session expiration vulnerabilityIn BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BI…EPSS 0.66%9.8CVE-2020-5868F5 big-iq centralized management os command injection vulnerabilityIn BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems u…EPSS 2.2%9.8CVE-2016-5022F5 big-ip link controller improper access control vulnerabilityF5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1…EPSS 3.5%9.4CVE-2019-6665F5 big-ip application security manager vulnerabilityOn BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager…EPSS 1.1%9.1CVE-2021-23005F5 big-iq centralized management vulnerabilityOn all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not ma…EPSS 1.00%

Source: NIST National Vulnerability Database (record CVE-2021-23024), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.