CVE-2023-43124

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
F5	BIG-IP Edge Client	>= 7.2.3, < *
F5	F5 Access	>= 3.0, < *

References

https://my.f5.com/manage/s/article/K000136907Mitigation, Vendor Advisory
https://my.f5.com/manage/s/article/K000136907Mitigation, Vendor Advisory

Timeline

Published: Sep 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-431258.2BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS CVE-2023-431289.8D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.CVE-2023-431299.8D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT paramete CVE-2023-431309.8D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.CVE-2023-431319.8General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.CVE-2023-431326.5szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the admin CVE-2023-431349.8There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the d CVE-2023-431359.8There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensiti CVE-2023-431378.8TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authenticat CVE-2023-431388.8TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentica CVE-2023-431399.8An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/val CVE-2023-43147.2The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This