CVE-2023-22842

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 16.1.0, < 16.1.3.3; >= 15.1.0, < 15.1.8.1; >= 14.1.0, < 14.1.5.3; >= 13.1.0, < *

References

https://my.f5.com/manage/s/article/K08182564Vendor Advisory
https://my.f5.com/manage/s/article/K08182564Vendor Advisory

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-228434.8An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definit CVE-2023-228449.8An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-craft CVE-2023-228457.5An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A spec CVE-2023-228465.5Datakit CrossCadWare_x64.dll contains an out-of-bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT fil CVE-2023-228474.3Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) create CVE-2023-228485.5Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potent CVE-2023-228496.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.CVE-2023-22854.3The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This i CVE-2023-228508.8Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.CVE-2023-228517.2Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.CVE-2023-228526.5Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.CVE-2023-228538.8Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.