CVE-2024-37028

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-645 CWE-287

Affected software

Vendor	Product	Versions
F5	BIG-IP Next Central Manager	>= 20.1.0, < 20.2.1
f5	big-ip_next_central_manager	>= 20.1.0, < 20.2.1

References

https://my.f5.com/manage/s/article/K000139938Vendor Advisory

Timeline

Published: Aug 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-370297.8Fuji Electric Tellus Lite V-Simulator is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary co CVE-2024-37034.7The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the CVE-2024-370309.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free.CVE-2024-370316.1The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create e CVE-2024-370328.8Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles CVE-2024-370345.9An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the CVE-2024-370369.8CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa CVE-2024-370378.1CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate CVE-2024-370388.8CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface CVE-2024-370397.5CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra CVE-2024-37049.8SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to CVE-2024-370408.1CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to