CVE-2026-42937

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 21.0.0, < 21.0.0.2; >= 17.5.0, < 17.5.1.6; >= 17.1.0, < 17.1.3.2; >= 16.1.0, < *
F5	BIG-IQ	>= 8.4.0, < *

References

https://my.f5.com/manage/s/article/K000161018Mitigation, Vendor Advisory

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-429418.3The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.CVE-2026-429447.5NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID a CVE-2026-429458.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite dire CVE-2026-429467.4A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an ov CVE-2026-429478.8A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device t CVE-2026-429484.8Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious d CVE-2026-429495.6A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r CVE-2026-42957.8Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat CVE-2026-429505.1ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while CVE-2026-429515.4An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password CVE-2026-429527.5Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to CVE-2026-429538.4The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past t