CVE-2017-6131 Hardcoded credentials in BIG-IP Azure cloud instance

Critical 9.8 Published 23 May 2017 Updated 5 Aug 2024

Attackers can remotely access F5 BIG-IP Azure instances via SSH using a default administrative password created during deployment.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6131?

CVE-2017-6131 is a critical vulnerability in F5 Big-Ip Access Policy Manager, published on 23 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment. The root and admin accounts are not vulnerable. An attacker may be able to remotely access the BIG-IP host via SSH.

Weakness: CWE-798

Which versions are affected by CVE-2017-6131?

It affects 9 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System, F5 Big-Ip Link Controller and 3 more.

How do I fix CVE-2017-6131?

No fix has been published for CVE-2017-6131 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-6131 being exploited?

There is no known exploitation of CVE-2017-6131 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-jgc9-5f5f-87mg.