CVE Feed

    Dashboard / CVE / CVE-2024-32049

    CVE-2024-32049

    BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published:May 8, 2024
    Last Modified:Dec 12, 2024
    EPS:May 8, 2024
    EPSS Score:0.00319
    CVSS Score:7.4

    Affected Products

    Vendor
    F5
    Product
    Big-ip Next Central Manager

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-54500 (CVSS 6.9) — An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in or…
    CVE-2025-36504 (CVSS 8.7) — When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an …
    CVE-2025-41399 (CVSS 8.7) — When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requ…
    CVE-2025-23413 (CVSS 6.7) — When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sen…
    CVE-2025-24319 (CVSS 7.1) — When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can c…
    CVE-2024-37028 (CVSS 6.3) — BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note:…
    CVE-2024-39809 (CVSS 8.9) — The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions …
    CVE-2024-41719 (CVSS 5.1) — When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credenti…
    CVE-2024-26026 (CVSS 7.5) — An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions w…
    CVE-2024-21793 (CVSS 7.5) — An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High