PT-2024-19061 · F5 · Big-Ip Next Central Manager

Published 2024-05-08 · Updated 2025-09-18 · CVE-2024-21793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Next Central Manager (affected versions not specified)

Description An OData injection vulnerability exists in the BIG-IP Next Central Manager API. The issue affects the API endpoint, but specific details about the endpoint, such as /api/v1/login or /users/{id}, are not provided. No information is available about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2024-21793

Affected Products

Big-Ip Next Central Manager

References · 28

• https://my.f5.com/manage/s/article/K000138732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21793 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21793 · Vendor Advisory
• https://t.me/netlas/184 · Telegram Post
• https://twitter.com/ggrubamn/status/1789787711899115584 · Twitter Post
• https://twitter.com/pcasano/status/1790007876528013542 · Twitter Post
• https://twitter.com/vuldb/status/1788391959679361426 · Twitter Post
• https://t.me/cvenotify/79612 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1788248130766406076 · Twitter Post
• https://twitter.com/hasdid/status/1798864227723014159 · Twitter Post
• https://twitter.com/PVynckier/status/1789308417942646922 · Twitter Post
• https://t.me/cveNotify/134424 · Telegram Post
• https://twitter.com/transilienceai/status/1791116632858780045 · Twitter Post
• https://twitter.com/rfwaveio/status/1788385844522356888 · Twitter Post
• https://twitter.com/cracbot/status/1788498362804605339 · Twitter Post