CVE-2020-5947
In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE).
Published:Nov 19, 2020
Last Modified:Nov 21, 2024
EPS:Nov 19, 2020
EPSS Score:0.00185
CVSS Score:4.3
Affected Products
Vendor
Product
Action
Vendor
F5
Product
Big-ip 2000
F5
Big-ip 2000
Vendor
F5
Product
Big-ip 4000
F5
Big-ip 4000
Vendor
F5
Product
Big-ip Access Policy Manager
F5
Big-ip Access Policy Manager
Vendor
F5
Product
Big-ip Advanced Firewall Manager
F5
Big-ip Advanced Firewall Manager
Vendor
F5
Product
Big-ip Advanced Web Application Firewall
F5
Big-ip Advanced Web Application Firewall
Vendor
F5
Product
Big-ip Analytics
F5
Big-ip Analytics
Vendor
F5
Product
Big-ip Application Acceleration Manager
F5
Big-ip Application Acceleration Manager
Vendor
F5
Product
Big-ip Application Security Manager
F5
Big-ip Application Security Manager
Vendor
F5
Product
Big-ip Ddos Hybrid Defender
F5
Big-ip Ddos Hybrid Defender
Vendor
F5
Product
Big-ip Domain Name System
F5
Big-ip Domain Name System
Vendor
F5
Product
Big-ip Fraud Protection Service
F5
Big-ip Fraud Protection Service
Vendor
F5
Product
Big-ip Global Traffic Manager
F5
Big-ip Global Traffic Manager
Vendor
F5
Product
Big-ip I2000
F5
Big-ip I2000
Vendor
F5
Product
Big-ip I4000
F5
Big-ip I4000
Vendor
F5
Product
Big-ip Link Controller
F5
Big-ip Link Controller
Vendor
F5
Product
Big-ip Local Traffic Manager
F5
Big-ip Local Traffic Manager
Vendor
F5
Product
Big-ip Policy Enforcement Manager
F5
Big-ip Policy Enforcement Manager
Vendor
F5
Product
Big-ip Virtual Edition
F5
Big-ip Virtual Edition
Vendor
F5
Product
Ssl Orchestrator
F5
Ssl Orchestrator
Exploits
No exploit reference
Common Weakness Enumeration
No CWE recorded yet
Common Attack Pattern Enumeration and Classification (CAPEC)
No CAPEC recorded yet
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
