CVE Feed

    Dashboard / CVE / CVE-2019-6609

    CVE-2019-6609

    Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms.

    Published:Apr 15, 2019
    Last Modified:Nov 21, 2024
    EPS:Apr 15, 2019
    EPSS Score:0.0047
    CVSS Score:9.8

    Affected Products

    Vendor
    F5
    Product
    Big-ip Access Policy Manager
    Vendor
    F5
    Product
    Big-ip Advanced Firewall Manager
    Vendor
    F5
    Product
    Big-ip Analytics
    Vendor
    F5
    Product
    Big-ip Application Acceleration Manager
    Vendor
    F5
    Product
    Big-ip Application Security Manager
    Vendor
    F5
    Product
    Big-ip Domain Name System
    Vendor
    F5
    Product
    Big-ip Edge Gateway
    Vendor
    F5
    Product
    Big-ip Fraud Protection Service
    Vendor
    F5
    Product
    Big-ip Global Traffic Manager
    Vendor
    F5
    Product
    Big-ip I10600
    Vendor
    F5
    Product
    Big-ip I10800
    Vendor
    F5
    Product
    Big-ip I11600
    Vendor
    F5
    Product
    Big-ip I11800
    Vendor
    F5
    Product
    Big-ip I15600
    Vendor
    F5
    Product
    Big-ip I15800
    Vendor
    F5
    Product
    Big-ip I2000s
    Vendor
    F5
    Product
    Big-ip I2200s
    Vendor
    F5
    Product
    Big-ip I4000s
    Vendor
    F5
    Product
    Big-ip I4200v
    Vendor
    F5
    Product
    Big-ip I5000s
    Vendor
    F5
    Product
    Big-ip I5050s
    Vendor
    F5
    Product
    Big-ip I5200v
    Vendor
    F5
    Product
    Big-ip I5250v
    Vendor
    F5
    Product
    Big-ip I5250v Fips
    Vendor
    F5
    Product
    Big-ip I7000
    Vendor
    F5
    Product
    Big-ip I7050s
    Vendor
    F5
    Product
    Big-ip I7055s
    Vendor
    F5
    Product
    Big-ip I7200v
    Vendor
    F5
    Product
    Big-ip I7200v-ssl
    Vendor
    F5
    Product
    Big-ip I7200v Fips
    Vendor
    F5
    Product
    Big-ip I7250v
    Vendor
    F5
    Product
    Big-ip I7255s
    Vendor
    F5
    Product
    Big-ip Link Controller
    Vendor
    F5
    Product
    Big-ip Local Traffic Manager
    Vendor
    F5
    Product
    Big-ip Policy Enforcement Manager
    Vendor
    F5
    Product
    Big-ip Webaccelerator
    Vendor
    F5
    Product
    Big-ip Webaccelerator12.1.1

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-39458 (CVSS 8.7) — When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, A…
    CVE-2026-20732 (CVSS 2.3) — A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof…
    CVE-2026-20730 (CVSS 2) — A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to ga…
    CVE-2025-61990 (CVSS 8.7) — When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Managem…
    CVE-2025-61933 (CVSS 5.1) — A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows a…
    CVE-2025-58071 (CVSS 8.7) — When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkerne…
    CVE-2025-54755 (CVSS 6.9) — A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to a…
    CVE-2025-59483 (CVSS 8.5) — A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions…
    CVE-2025-59481 (CVSS 8.5) — A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an …
    CVE-2025-61960 (CVSS 8.7) — When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High