{"id":"CVE-2023-22374","published":"2023-02-01T17:54:46Z","modified":"2025-03-26T17:51:00Z","title":"iControl SOAP vulnerability","vendor":"F5","product":"BIG-IP","tier":"core","eol":null,"affectedVersions":[{"vendor":"F5","product":"BIG-IP","versions":[">= 17.0.0, < 17.1.0",">= 16.1.2.2, < 16.1.3.4",">= 15.1.5.1, < 15.1.8.2",">= 14.1.4.6, < 14.1.5.4",">= 13.1.5"]}],"description":{"text":"\nA format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a format string vulnerability in the iControl SOAP component of F5's BIG-IP product. An attacker with valid authentication and network access can exploit it to crash the iControl SOAP CGI process or potentially execute arbitrary code, and in appliance mode the exploit can allow crossing a security boundary.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:00Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.70782,"percentile":0.99396,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | K000130415: Vulnerabilidad SOAP de iControl CVE-2023-22374 | F5","url":"https://otx.alienvault.com/pulse/63de9746e548c88972810103","created":"2023-02-04"}],"provenance":"machine"},"cwes":[{"id":"CWE-134","name":"Use of Externally-Controlled Format String"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000130415","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26537","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26537","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-02-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-22374","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}