SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2014-2927

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does…

HIGH 9.3EPSS 7.92%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

CVSS 2.0
9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
7.92% probability · 94th percentile
CISA KEV
Not listed
Weakness
CWE-287
Affected
f5/arx · f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip edge gateway · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip protocol security module · f5/big-ip wan optimization manager · f5/big-ip webaccelerator · f5/big-iq cloud · f5/big-iq device · f5/big-iq security · f5/enterprise manager · f5/firepass
Source
cret@cert.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.