CVE-2023-22374— iControl SOAP vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-22374
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
iControl SOAP vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用外部控制的格式字符串
Source: NVD (National Vulnerability Database)
Vulnerability Title
F5 BIG-IP 格式化字符串错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。 F5 BIG-IP 存在格式化字符串错误漏洞，该漏洞源于iControl SOAP 中存在格式字符串漏洞，攻击者利用该漏洞可以使 iControl SOAP CGI 进程崩溃或执行任意代码，以下产品和版本受到影响：BIG-IP (AFM) 17.0.0、16.1.0 到16.1.3、15.1.0 到 15.1.7、14.1.0 到 14.1.5、13.1.0 到 13.1.5版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-22374
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-22374
请登录查看更多情报信息。
Same Patch Batch · F5 · 2023-02-01 · 17 CVEs total
| CVE-2023-22358 | 7.8 HIGH | BIG-IP Edge Client for Windows vulnerability |
| CVE-2023-23555 | 7.5 HIGH | BIG-IP Virtual Edition vulnerability |
| CVE-2023-23552 | 7.5 HIGH | BIG-IP Advanced WAF and ASM vulnerability |
| CVE-2023-22842 | 7.5 HIGH | BIG-IP SIP profile vulnerability |
| CVE-2023-22839 | 7.5 HIGH | BIG-IP DNS profile vulnerability |
| CVE-2023-22664 | 7.5 HIGH | BIG-IP HTTP/2 profile vulnerability |
| CVE-2023-22422 | 7.5 HIGH | HTTP profile vulnerability |
| CVE-2023-22341 | 7.5 HIGH | BIG-IP APM OAuth vulnerability |
| CVE-2023-22340 | 7.5 HIGH | BIG-IP SIP profile vulnerability |
| CVE-2023-22323 | 7.5 HIGH | BIG-IP SSL OCSP Authentication profile vulnerability |
| CVE-2023-22281 | 7.5 HIGH | BIG-IP AFM vulnerability |
| CVE-2023-22657 | 7.0 HIGH | F5OS vulnerability |
| CVE-2023-22283 | 6.5 MEDIUM | BIG-IP Edge Client for Windows vulnerability |
| CVE-2023-22418 | 6.1 MEDIUM | BIG-IP APM virtual server vulnerability |
| CVE-2023-22302 | 5.9 MEDIUM | BIG-IP HTTP profile vulnerability |
| CVE-2023-22326 | 4.9 MEDIUM | iControl REST and tmsh vulnerability |
IV. Related Vulnerabilities
Same weakness: CWE-134
- CVE-2026-44407
Remote Denial of Service Vulnerability Exists in ZTE Cloud P - CVE-2026-6539
Notepad++ 8.9.3 Format String Injection via nativeLang.xml - CVE-2026-6843
Nano: nano: format string vulnerability leads to denial of s - CVE-2026-3509
CODESYS Control Audit Log Format String DoS - CVE-2026-33210
Ruby JSON has a format string injection vulnerability
V. Comments for CVE-2023-22374
No comments yet