CVE-2023-46747

Imagine your BIG-IP device is a building’s security desk. This bug lets a person who can get to the desk’s “public” doors press buttons that execute commands on the building’s computers—without showing any badge (no login required). If an attacker can reach the exposed network routes (management port or self IPs), they can potentially take over the device and cause outages or enable ransomware.

This matters if your business uses BIG-IP (including its major modules like access policy management, local traffic management, and similar) to route traffic, protect applications, or manage security policies. It also matters most if the BIG-IP management port or self IP addresses are reachable from untrusted networks, because the vulnerability requires only network reachability—not a password or user login. This is a risk when attackers can reach those interfaces from the network (including via internet exposure or other untrusted network paths).

This is RED because it is confirmed in CISA’s KEV and has been used in ransomware campaigns. Attackers don’t need credentials or user interaction—only network access to the BIG-IP management port or self IP addresses—so exposed systems can be actively targeted.