CVE-2023-46748

HIGH 8.8

⚠️ CISA KEV

BIG-IP Configuration utility authenticated SQL injection vulnerability

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CWE	CWE-89
Vendor	f5
Product	big-ip
Published	Oct 26, 2023
Last Updated	Oct 21, 2025

⚠️ Actively Exploited — Act Now

Get instant alerts for f5 big-ip

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2023-46748.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

F5 / BIG-IP

17.1.0 < * 16.1.0 < * 15.1.0 < * 14.1.0 < * 13.1.0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

my.f5.com: https://my.f5.com/manage/s/article/K000137365 secpod.com: https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748

Credits

F5 acknowledges researchers who would like to remain anonymous for bringing this issue to our attention and following the highest standards of coordinated disclosure.