CVE-2023-46747

Imagine your BIG-IP device is a building’s security desk. This bug lets a person who can get to the desk’s “public” doors press buttons that execute commands on the building’s computers—without showing any badge (no login required). If an attacker can reach the exposed network routes (management port or self IPs), they can potentially take over the device and cause outages or enable ransomware.

This matters if your business uses BIG-IP (including its major modules like access policy management, local traffic management, and similar) to route traffic, protect applications, or manage security policies. It also matters most if the BIG-IP management port or self IP addresses are reachable from untrusted networks, because the vulnerability requires only network reachability—not a password or user login. This is a risk when attackers can reach those interfaces from the network (including via internet exposure or other untrusted network paths).

This is RED because it is confirmed in CISA’s KEV and has been used in ransomware campaigns. Attackers don’t need credentials or user interaction—only network access to the BIG-IP management port or self IP addresses—so exposed systems can be actively targeted.

Confirm exposure (fast)

1. Determine how BIG-IP is connected to your networks.
2. Check whether the BIG-IP management port and/or any self IPs are reachable from untrusted sources (internet, guest networks, partner networks, or anything not strictly controlled/administrative).
3. If you can reach the management UI/management endpoints from anything besides your trusted admin networks, treat that as exposure.

Determine if you’re affected

1. Identify the exact BIG-IP version and the installed BIG-IP product modules (access policy management, local traffic manager, etc.).
2. Use the vendor guidance for CVE-2023-46747 (F5 advisory article) to determine whether your specific version is impacted and what mitigation/upgrade applies.
   • Vendor link: https://my.f5.com/manage/s/article/K000137353

Apply the fix / mitigation

1. If your device is reachable from untrusted networks, apply F5’s mitigations immediately as described in the vendor article.
2. If mitigations are unavailable for your configuration/version, discontinue use of the product as CISA instructs, and take the device offline until remediated.
3. Upgrade BIG-IP according to the vendor’s recommended version line(s) that address this unauthenticated remote command execution risk.

Required timing (KEV)

• CISA KEV remediation due date was 2023-11-21.

Temporary containment if patching is delayed

• Restrict network reachability so the BIG-IP management port/self IPs are not reachable from untrusted networks.
• Ensure only your trusted administration networks can access the management interface.

What to monitor after changes

• BIG-IP management-plane logs and any indicators of command execution/abnormal administrative activity.
• Network logs for repeated probes/requests to management endpoints.
• Confirm that the device remains operational for its intended traffic/security roles after the mitigation/upgrade.

CVE-2023-46747 is a critical remote code execution issue (CWE-288: authentication bypass; CWE-306: missing authentication for critical function) affecting BIG-IP. The mechanism is an unauthenticated path in the BIG-IP configuration utility: when requests reach the BIG-IP through the management port or self IP addresses, an attacker can bypass authentication and execute arbitrary system commands.

Exploitation status: Listed in CISA’s KEV as used in ransomware campaigns (real-world exploitation confirmed by CISA). Public exploit code exists (weaponized).

Impact shape: Because it’s unauthenticated and remote, successful exploitation can lead to full compromise of the BIG-IP system, enabling further intrusion, persistence, and operational disruption.

No reliable “fixed in version” details were provided in the findings; remediation must follow F5’s vendor instructions for CVE-2023-46747.

Note: The findings also indicate that software no longer supported by the vendor (end of technical support) is not evaluated by the source material.