Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.

CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities

An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

A public PoC has been released, increasing the likelihood of exploitation by threat actors

F5 BIG-IP Next Central Manager version 20.0.1 < 20.2.0 is affected by a SQL Injection. An unauthenticated, remote attacker can exploit this to bypass authentication or extract information such as user hashes.

The version of the Big-IP Next Central Manager installed on the remote Windows host is between 20.0.1 and 20.1.0.
It is, therefore, affected by an SQL Injection vulnerability as referenced in the K000138733 advisory. An unauthenticated attacker can exploit this vulnerability to execute malicious SQL statements through the BIG-IP NEXT Central Manager API (URI).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114281	F5 BIG-IP Next Central Manager SQL Injection	Web App Scanning	Component Vulnerability	high
195236	F5 BIG-IP Next Central Manager 20.0.1 < 20.2.0 SQL Injection (K000138733)	Nessus	F5 Networks Local Security Checks	high
195211	F5 BIG-IP Next Central Manager < 20.2.0 SQLi (K000138733) (Direct Check)	Nessus	Web Servers	high

Detections

Analytics

CVE-2024-26026

high

Tenable Plugins

high

high

high