CVE-2023-46747

What it actually does

CVE-2023-46747 is an unauthenticated authentication-bypass vulnerability in the F5 BIG-IP Configuration utility, also known as TMUI. A remote attacker with network reachability to the BIG-IP management interface or exposed self IP management services can bypass expected authentication controls and reach administrative functionality. Successful exploitation can lead to arbitrary operating-system command execution on the appliance with high privileges, enabling full compromise of BIG-IP configuration, traffic-handling policy, secrets, authentication material, and availability.

Why it matters to the business

A compromised BIG-IP device can become a high-impact breach point because these systems often sit in front of critical applications, terminate TLS, enforce access policies, and route production traffic. Attackers can steal configuration and credentials, alter traffic handling, deploy persistence, disrupt application delivery, or use the device as a foothold into internal networks. This vulnerability is in CISA KEV, has a very high EPSS score, is known to be actively exploited in the wild, and has been associated with ransomware activity, so internet- or broadly reachable management interfaces should be treated as urgent incident-response priorities rather than routine patching items.

How an attack unfolds

An attacker first identifies BIG-IP management or Configuration utility exposure on the management port or through reachable self IP addresses. Because the flaw requires no credentials, no user interaction, and low attack complexity, the attacker sends crafted requests to bypass the Configuration utility authentication layer and access administrative or command-execution paths. Once command execution is obtained, the attacker may enumerate system information, create or modify administrative users, run shell or tmsh commands, retrieve configuration files and secrets, stage web shells or scripts, alter traffic policy, and establish persistence. In observed exploitation campaigns, threat actors rapidly weaponized the issue after disclosure; systems not patched by the CISA KEV due date of 2023-11-21 should be assumed exposed if reachable during the exploitation window, especially where management access was internet-facing or insufficiently restricted.

How to fix it

Upgrade affected F5 BIG-IP installations to a vendor-fixed release or apply the relevant F5 hotfix for the deployed branch. If immediate upgrade is not possible, restrict Configuration utility access to trusted administrative networks only, block access to TMUI and management services from the internet, enforce management-plane firewalling, and ensure self IP addresses do not expose management services except where explicitly required. Use F5-recommended mitigations such as disabling or tightly controlling Configuration utility access through self IPs, using port lockdown, and applying vendor-provided mitigation scripts only as temporary compensating controls. Rotate credentials, API tokens, and certificates if exploitation is suspected, and review for unauthorized users or configuration changes. End-of-Technical-Support versions should be upgraded to supported fixed branches because they may not receive complete evaluation or fixes.

How to confirm the fix worked

Confirm the deployed BIG-IP version and hotfix level against F5’s advisory for CVE-2023-46747 and verify that it is no longer in an affected range. Validate that the Configuration utility is not reachable from untrusted networks by testing management-port and self IP exposure from external and internal network segments. Review self IP port-lockdown settings and management ACLs to ensure only approved administrative sources can reach TMUI and related management services. Confirm no unauthorized BIG-IP users, iControl REST tokens, shell accounts, scheduled tasks, startup scripts, or unexpected configuration changes exist. Where vulnerability scanning is used, run authenticated version checks and unauthenticated exposure checks; do not rely only on banner detection because BIG-IP deployments may hide version details.

Typical attack path

1. Scan for reachable F5 BIG-IP management, TMUI, or exposed self IP management services.
2. Confirm the Configuration utility is accessible over the network.
3. Send crafted unauthenticated requests that bypass TMUI authentication.
4. Invoke administrative functionality or command-execution-capable endpoints.
5. Run operating-system or tmsh commands to enumerate the appliance and privileges.
6. Create or modify local administrative users, tokens, or configuration for persistence.
7. Collect BIG-IP configuration, certificates, credentials, access-policy data, or traffic-management secrets.
8. Use the compromised appliance to pivot, alter application delivery, disrupt service, or support ransomware operations.

How to detect it

Review BIG-IP management-plane logs for suspicious unauthenticated access and post-exploitation activity. Key sources include /var/log/httpd/access_log, /var/log/httpd/error_log, /var/log/tomcat/catalina.out, /var/log/ltm, /var/log/audit, /var/log/restjavad*, shell history, configuration archives, and authentication logs. Look for unexpected POST requests to TMUI paths, access to iControl REST utility endpoints, requests containing authentication-bypass artifacts, new or modified administrative users, command execution through REST utility endpoints, unusual tmsh activity, configuration saves outside change windows, unexpected file writes under web or temporary directories, and outbound connections from the appliance. Correlate HTTP requests from unknown sources with audit events showing user creation, password changes, role changes, shell access, tmsh execution, or service restarts. If StrikeShark or ransomware-related activity is a concern, expand hunting to include rapid reconnaissance after initial access, credential dumping, archive creation, staging of scripts or binaries, and outbound connections to unfamiliar infrastructure.

• POST /tmui/Control/form
• /tmui/Control/form
• /tmui/login.jsp
• /mgmt/tm/util/bash
• /mgmt/tm/util/tmsh
• /mgmt/tm/auth/user
• /mgmt/tm/shared/authn/login
• X-F5-Auth-Token
• adminRole
• partition-access
• tmsh create auth user
• tmsh modify auth user
• create auth user
• modify auth user
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/tomcat/catalina.out
• /var/log/audit
• /var/log/ltm
• /var/log/restjavad.log
• /var/tmp/
• /tmp/
• /config/bigip.conf
• /config/bigip_user.conf

What your security team should do

• Treat any reachable, unpatched BIG-IP management interface as potentially compromised due to active exploitation, KEV listing, high EPSS likelihood, and ransomware association.
• Patch or hotfix all affected BIG-IP systems immediately, prioritizing internet-facing management interfaces and self IPs exposing management services.
• Remove public or broad network access to TMUI; restrict management access to dedicated administrative networks, VPN, bastion hosts, or jump servers.
• Hunt historical logs from at least the publication date onward, with emphasis on the period before and after the 2023-11-21 CISA KEV due date.
• Review appliance user accounts, authentication tokens, SSH keys, scheduled jobs, startup scripts, and configuration archives for unauthorized changes.
• Rotate local admin passwords, API credentials, device trust material, and certificates if compromise cannot be confidently ruled out.
• Capture forensic images or support bundles before remediation when active compromise is suspected, preserving HTTP, audit, shell, and configuration logs.
• Monitor for outbound connections from BIG-IP appliances, because management devices should rarely initiate arbitrary external network traffic.