PT-2023-1379 · F5 · Big-Ip Edge Client

Published 2023-02-01 · Updated 2023-10-04 · CVE-2023-22283

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP Edge Client for Windows versions 7.1.5 through 7.2.3.1

Description The issue is related to a DLL hijacking vulnerability in the BIG-IP Edge Client for Windows. Exploitation of this vulnerability may allow an attacker to execute arbitrary commands. User interaction and administrative privileges are required to exploit this vulnerability, as the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path.

Recommendations For versions 7.1.5 through 7.2.3.1, update to a version after 7.2.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the trusted search path to minimize the risk of exploitation. Additionally, avoid running the executable on the system unless necessary, and ensure that administrative privileges are properly secured to prevent unauthorized modifications.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2023-00736

CVE-2023-22283

Affected Products

Big-Ip Edge Client

References · 8

• https://my.f5.com/manage/s/article/K07143733 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00736 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22283 · Security Note
• https://vuldb.com/ru/?id.219979 · Note
• https://t.me/cvenotify/43354 · Telegram Post
• https://t.me/cvenotify/43355 · Telegram Post
• https://t.me/cibsecurity/57327 · Telegram Post