Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.

CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities

An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A public PoC has been released, increasing the likelihood of exploitation by threat actors

F5 BIG-IP Next Central Manager version 20.0.1 < 20.2.0 is affected by a SQL Injection. An unauthenticated, remote attacker can exploit this to bypass authentication or extract information such as user hashes.

An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The version of the Big-IP Next Central Manager installed on the remote Windows host is between 20.0.1 and 20.1.0.
It is, therefore, affected by an OData Injection vulnerability as referenced in the K000138732 advisory. An unauthenticated attacker can exploit this vulnerability to execute malicious SQL statements through the BIG-IP NEXT Central Manager API (URI).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114281	F5 BIG-IP Next Central Manager SQL Injection	Web App Scanning	Component Vulnerability	high
196951	F5 BIG-IP Next Central Manager < 20.2.0 SQLi (K000138732) (Direct Check)	Nessus	Web Servers	high
195237	F5 BIG-IP Next Central Manager 20.0.1 < 20.2.0 OData Injection (K000138732)	Nessus	F5 Networks Local Security Checks	high

Detections

Analytics

CVE-2024-21793

high

Tenable Plugins

high

high

high