The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.6 / 15.1.5.1 / 16.1.2.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K24624116 advisory.

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).(CVE-2021-23840)ImpactAn attacker may trigger a buffer     overflow resulting in a core file and denial of service (DoS).

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

F5 Networks BIG-IP : OpenSSL vulnerability (K24624116)

high Nessus Plugin ID 154690

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Feb 6, 2026, 5:01 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602061701
Version 1.4 Jan 8, 2024, 11:12 AM Plugin metadata Plugin Feed: 202401081112
Version 1.3 Nov 3, 2023, 7:56 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202311030756