CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection

Exploited in the wild High 8.8 Published 26 Oct 2023 Updated 21 Oct 2025

Authenticated attackers can execute arbitrary system commands via SQL injection in the BIG-IP Configuration utility.

Exploited in the wild: Since 31 Oct 2023
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-46748?

CVE-2023-46748 is a high-severity SQL injection vulnerability in F5 Big-Ip Access Policy Manager, published on 26 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which

may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Weakness: CWE-89

Which versions are affected by CVE-2023-46748?

It affects 20 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager and 14 more.

How do I fix CVE-2023-46748?

No fix has been published for CVE-2023-46748 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Nov 2023.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-46748 being exploited?

Yes. Attackers have exploited CVE-2023-46748 in the wild since at least 31 Oct 2023.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-9h42-3pgf-qjc8.