CVE-2016-5745 Missing authorization in n/a

What is CVE-2016-5745?

CVE-2016-5745 is a critical missing authorization vulnerability in F5 Big-Ip Local Traffic Manager, published on 5 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.

Weakness: CWE-284

Which versions are affected by CVE-2016-5745?

It affects 1 product.

Products include F5 Big-Ip Local Traffic Manager.

How do I fix CVE-2016-5745?

No fix has been published for CVE-2016-5745 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2016-5745 being exploited?

There is no known exploitation of CVE-2016-5745 in the wild and no public exploit code.

Other vulnerabilities in F5 Big-Ip Local Traffic Manager

• CVE-2020-5936 Denial of service in BIG-IP LTM High 7.5
• CVE-2019-6681 Denial of service in BIG-IP High 7.5
• CVE-2018-17539 Denial of service in n/a High 7.5
• CVE-2014-8727 Path traversal in n/a Medium 6.2
• CVE-2019-6590 Denial of service in BIG-IP (LTM) Medium 5.9

All F5 Big-Ip Local Traffic Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-74wr-ff4p-4w38.