CVE-2020-5947 Information disclosure in BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE)

Medium 4.3 Published 19 Nov 2020 Updated 4 Aug 2024

Attackers can obtain TCP sequence numbers from specific BIG-IP platforms, potentially allowing connection hijacking or spoofing.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5947?

CVE-2020-5947 is a medium-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 19 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE).

Which versions are affected by CVE-2020-5947?

It affects 14 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager and 8 more.

How do I fix CVE-2020-5947?

No fix has been published for CVE-2020-5947 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5947 being exploited?

There is no known exploitation of CVE-2020-5947 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-253r-3vgg-gj92.