PT-2020-18761 · F5 · Big-Iq+1

Published 2020-03-27 · Updated 2021-07-21 · CVE-2020-5860

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.2 through 15.1.0.2 BIG-IQ versions 5.2.0 through 7.0.0

Description The failover service in a High Availability (HA) network failover in Device Service Cluster (DSC) does not require a strong form of authentication. Additionally, HA network failover traffic is not encrypted by Transport Layer Security (TLS).

Recommendations For BIG-IP versions 11.5.2 through 15.1.0.2, consider implementing strong authentication for the failover service and enabling Transport Layer Security (TLS) encryption for HA network failover traffic. For BIG-IQ versions 5.2.0 through 7.0.0, consider implementing strong authentication for the failover service and enabling Transport Layer Security (TLS) encryption for HA network failover traffic. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-287

CWE-319

Related Identifiers

CVE-2020-5860

Affected Products

Big-Ip

Big-Iq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-5860 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5860 · Vendor Advisory
• https://support.f5.com/csp/article/K67472032 · Vendor Advisory
• https://t.me/cvenotify/2236 · Telegram Post