What is CVE-2022-23024?

CVE-2022-23024 is a high-severity vulnerability in F5 Big-Ip Advanced Firewall Manager, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2022-01-25.

How severe is CVE-2022-23024?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in F5 Big-Ip Advanced Firewall Manager

CVE-2022-23024

On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec application layer gateway (ALG) logging profile is configured on an IPsec ALG virtual server, undisclosed IPsec traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.009 (56.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

F5 Big-ip_advanced_firewall_manager
N/a Big-ip Afm — versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

f5sirt@f5.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-23024?: CVE-2022-23024 is a high-severity vulnerability in F5 Big-Ip Advanced Firewall Manager, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2022-01-25.
How severe is CVE-2022-23024?: High severity. CVSS v3 base score is 7.5 out of 10.