CVE-2019-6650 Information disclosure in BIG-IP ASM

What is CVE-2019-6650?

CVE-2019-6650 is a critical vulnerability in F5 Big-Ip Application Security Manager, published on 20 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.

Which versions are affected by CVE-2019-6650?

It affects 1 product.

Products include F5 Big-Ip Application Security Manager.

How do I fix CVE-2019-6650?

No fix has been published for CVE-2019-6650 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-6650 being exploited?

There is no known exploitation of CVE-2019-6650 in the wild and no public exploit code.

Other vulnerabilities in F5 Big-Ip Application Security Manager

• CVE-2019-6665 Other in BIG-IP ASM Critical 9.4
• CVE-2025-24326 BIG-IP Advanced WAF/ASM BADoS vulnerability High 8.9
• CVE-2025-55669 BIG-IP HTTP/2 vulnerability High 8.7
• CVE-2009-4420 Memory corruption in n/a High 7.8
• CVE-2021-23010 Denial of service in BIG-IP ASM/Advanced WAF High 7.5

All F5 Big-Ip Application Security Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cw93-7j95-j4hv.