CVE‑2023‑46748: F5 BIG‑IP Configuration Utility – SQL Injection Allows Authenticated Command Execution
What It Is — The BIG‑IP Configuration Utility contains an SQL‑injection flaw that can be leveraged by an attacker who has already authenticated to the management interface (or has network reach to the BIG‑IP self‑IP). Successful exploitation permits arbitrary system‑command execution.
Exploitability — Requires valid credentials and network access; no public exploit code is known, but the vulnerability is rated high (CVSS ≈ 8.8) and can be chained with CVE‑2023‑46747 for broader impact.
Affected Products — All F5 BIG‑IP appliances running the Configuration Utility prior to the vendor‑issued patch (see F5 security advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of privileged access to management interfaces – a core control for audit‑ready environments.
- Highlights gaps in configuration‑change governance; evidence of remediation (patch status, access logs) becomes essential proof for regulators and customers.
- Reinforces the requirement to segment management traffic and enforce strong authentication, a control that satisfies multiple frameworks (e.g., NIST CSF Identify / Protect).
Recommended Actions
- Deploy the F5‑provided patch for CVE‑2023‑46748 without delay.
- Enforce MFA and least‑privilege policies on all BIG‑IP management accounts.
- Restrict network access to the management port and self‑IP addresses via firewalls or zero‑trust segmentation.
- Run an authenticated vulnerability scan to confirm remediation and capture evidence for audit trails.
- Update your access‑control documentation and retain logs as demonstrable control evidence.
Source: CISA KEV – CVE‑2023‑46748