Vulnerability in F5 Big-Ip 2800
CVE-2020-5851
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (23.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 23.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- F5 Big-Ip 2800
- F5 Big-Ip Access Policy Manager — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Advanced Firewall Manager — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Analytics — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Application Acceleration Manager — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Application Security Manager — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Domain Name System — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Edge Gateway — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Fraud Protection Service — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
- F5 Big-Ip Global Traffic Manager — versions 14.1.0.2.0.45.4, 14.1.0.2.0.62.4
References
- support.f5.com/csp/article/K91171450 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5851?
- CVE-2020-5851 is a medium-severity vulnerability in F5 Big-Ip 2800. CVSS score: 4.6/10. Published 2020-01-14.
- How severe is CVE-2020-5851?
- Medium severity. CVSS v3 base score is 4.6 out of 10.