BIG-IP DNS profile vulnerability
Priority MEDIUM 40CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed BIG-IP (F5): 17.0.0.2, 16.1.3.3, 15.1.8.1 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| F5 | BIG-IP | 17.0.0 to before 17.0.0.2; 16.1.0 to before 16.1.3.3; 15.1.0 to before 15.1.8.1; 14.1.0 to before 14.1.5.3; 13.1.0 and later | 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 | Patch available | CNA |
- BIG-IP VendorF5 Affected 17.0.0 to before 17.0.0.2; 16.1.0 to before 16.1.3.3; 15.1.0 to before 15.1.8.1; 14.1.0 to before 14.1.5.3; 13.1.0 and later Fixed in 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 Patch available CNA
CPE configurations NVD · 66
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 13.1.0 – 13.1.5; 14.1.0 to before 14.1.5.3; 15.1.0 to before 15.1.7; 16.1.0 to before 16.1.3.3; 17.0.0 to before 17.0.0.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 13.1.0 – 13.1.5; 14.1.0 to before 14.1.5.3; 15.1.0 to before 15.1.7; 16.1.0 to before 16.1.3.3; 17.0.0 to before 17.0.0.2 | Vulnerable | F5 |
| cpe:2.3:o:f5:big-ip_10000s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_10000s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_10200v_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_10200v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_10200v-ssl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_10200v-ssl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_12000_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_12000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 13.1.0 – 13.1.5; 14.1.0 to before 14.1.5.3; 15.1.0 to before 15.1.7; 16.1.0 to before 16.1.3.3; 17.0.0 to before 17.0.0.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 13.1.5; 14.1.0 to before 14.1.5.3; 15.1.0 to before 15.1.7; 16.1.0 to before 16.1.3.3; 17.0.0 to before 17.0.0.2 Vulnerable ·F5
- cpe:2.3:o:f5:big-ip_10000s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_10000s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_10200v_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_10200v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_10200v-ssl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_10200v-ssl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_12000_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_12000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
Show 56 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:f5:big-ip_5000s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_5000s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_5200v_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_5200v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_5200v-ssl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_5200v-ssl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_7000s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_7000s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_7200v_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_7200v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_7200v-ssl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_7200v-ssl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i10600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i10600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i10800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i10800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i11600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i11600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i11800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i11800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i15600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i15600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i15800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i15800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i5600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i5800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i7600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i7600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:big-ip_i7800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:big-ip_i7800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r10600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r10600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r10800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r10800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r10900_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r10900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r5600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r5800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:r5900_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:r5900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:velos_bx110_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:velos_bx110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:viprion_b2100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:viprion_b2100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:viprion_b2150_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:viprion_b2150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:viprion_b2250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:viprion_b2250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:viprion_b4300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:viprion_b4300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
| cpe:2.3:o:f5:viprion_b4450_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | F5 |
| cpe:2.3:h:f5:viprion_b4450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | F5 |
- cpe:2.3:o:f5:big-ip_5000s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_5000s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_5200v_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_5200v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_5200v-ssl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_5200v-ssl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_7000s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_7000s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_7200v_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_7200v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_7200v-ssl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_7200v-ssl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i10600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i10600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i10800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i10800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i11600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i11600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i11800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i11800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i15600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i15600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i15800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i15800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i5600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i5800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i7600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i7600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:big-ip_i7800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:big-ip_i7800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r10600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r10600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r10800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r10800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r10900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r10900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r5600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r5800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:r5900_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:r5900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:velos_bx110_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:velos_bx110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:viprion_b2100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:viprion_b2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:viprion_b2150_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:viprion_b2150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:viprion_b2250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:viprion_b2250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:viprion_b4300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:viprion_b4300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
- cpe:2.3:o:f5:viprion_b4450_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·F5
- cpe:2.3:h:f5:viprion_b4450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·F5
Remediation
- Fix · CNA BIG-IP (F5) Fixed in 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
F5 BIG-IP 14.1.5.3, 15.1.8.1 and 2 more versions
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2023-08588 BIG-IP SSL OCSP Authentication profile vulnerabilityPriority LOW 34
- TI-2023-08591 iControl REST and tmsh vulnerabilityPriority LOW 23
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22839
- 2026-10-03 Alias added: GHSA-9mj7-f2wr-hjrv
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
More F5 Big-ip 10000s Firmware vulnerabilities
- TI-2019-08313 Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0… CVSS 3.1MEDIUM 4.4
Sources
- CVE-2023-22839 · CVE Program
- CVE-2023-22839 · NVD
- FIRST EPSS
- GHSA-9mj7-f2wr-hjrv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences