F5 BIG-IP CVE-2023-46747/46748: TMUI Auth Bypass to RCE

What to do

1. Inventory every BIG-IP and record its version and hotfix with tmsh show sys version.
2. Move anything still on 13.1, 14.1, 15.1 or 16.1 to a supported branch such as 17.1 or later, since those branches no longer receive fixes.
3. Confirm the TMUI is reachable only from a dedicated management network: check tmsh list sys httpd allow and set self-IP port lockdown so no self IP serves the Configuration utility.
4. List local users with tmsh list auth user and remove any account you cannot account for, then rotate admin passwords and keys.
5. Treat any device that was internet-exposed on an unfixed build in late 2023 as compromised: rebuild it and rotate stored secrets rather than cleaning it in place.

How to check if you are affected or compromised

• Search /var/log/audit for tmsh create auth user commands and for run util bash by unfamiliar accounts such as f5support3, F5_admin or f5_support.
• Search /var/log/restjavad-audit.log for POST requests to /mgmt/tm/util/bash from unexpected users or source IPs.
• Grep /var/log/tomcat/catalina.out for java.sql.SQLException: Column not found followed by sh: no job control in this shell, the CVE-2023-46748 indicator F5 published.
• Look for unexpected ELF files in /tmp (for example /tmp/watchsys) and for new home directories under /home.

What happened#

On October 26, 2023, F5 published two flaws in the BIG-IP Configuration utility, the web admin interface also called TMUI. CVE-2023-46747 lets "undisclosed requests" bypass authentication, so an unauthenticated attacker who can reach the utility can run arbitrary system commands. F5 scores it CVSS 3.1 9.8. CVE-2023-46748 is an authenticated SQL injection in the same utility that also leads to command execution, scored 8.8.

Praetorian's Thomas Hendrickson and Michael Weber found the first bug and reported it to F5 on October 5. Their write-up describes Apache JServ Protocol (AJP) request smuggling, closely related to CVE-2022-26377. A smuggled request creates an administrator account, and that account then runs bash through the REST API. A public proof of concept followed on October 30. The same day, F5 updated both advisories to warn of active exploitation in the wild, with the two bugs used together, as BleepingComputer and Help Net Security reported. CISA added both to the KEV catalog on October 31 and flags CVE-2023-46747 as known to be used in ransomware campaigns.

In March 2024, Mandiant attributed late-October 2023 exploitation to UNC5174. It describes the group as a suspected China-nexus actor that tried to sell access to US defense contractor appliances and UK government entities. After creating backdoor admins, the group ran F5's own mitigation script to lock out rival attackers.

Who is affected#

The affected branches are BIG-IP 13.1, 14.1, 15.1, 16.1 and 17.1, when the utility is reachable through the management port or a self IP. F5 shipped engineering hotfixes, listed in the CVE record and in advisories K000137353 and K000137365, for example Hotfix-BIGIP-17.1.1.0.2.6-ENG and Hotfix-BIGIP-15.1.10.2.0.44.2-ENG. According to F5's lifecycle page, BIG-IP 15.x reached end of technical support on December 31, 2024 and 16.1 on July 31, 2025. Of the affected branches, only 17.1 still gets fixes.

Do you really need to act?#

Most teams patched this in 2023. The risk today sits in two places. One is forgotten or end-of-life BIG-IPs that never took the hotfix and still expose TMUI, especially through a self IP on a public VLAN. The other is devices that were exploited in the window and still carry attacker accounts. Patching and the mitigation script do not remove accounts already created, and Mandiant saw attackers apply that script themselves. So "it shows as mitigated" does not prove "it is clean." F5 told customers that when there is any uncertainty, they should consider the device compromised.

What to do now#

1. Run tmsh show sys version on every BIG-IP and confirm the build includes the fix.
2. Upgrade anything on 13.1 through 16.1 to a supported branch, 17.1 or later.
3. Check tmsh list sys httpd allow and the self-IP allow-service settings (tmsh list net self all-properties). No self IP should serve the utility, and management access should come only from an admin network.
4. Review tmsh list auth user, delete unknown accounts, and rotate admin credentials.
5. Rebuild any device that was exposed and unfixed in late 2023, and rotate the certificates and secrets stored on it.

How to tell if you were hit#

Search /var/log/audit for create auth user and run util bash. Search /var/log/restjavad-audit.log for POSTs to /mgmt/tm/util/bash. Mandiant documented accounts named f5support3, F5_admin and f5_support, plus a downloader dropped at /tmp/watchsys. For the SQL injection, F5's published indicator is java.sql.SQLException: Column not found: 0. followed by sh: no job control in this shell in /var/log/tomcat/catalina.out. Logs rotate, so an empty result on a device exposed in 2023 proves little.

Timeline#

• Oct 5, 2023 — Praetorian reports CVE-2023-46747 to F5.
• Oct 26, 2023 — F5 publishes both advisories with engineering hotfixes.
• Oct 30, 2023 — A public proof of concept appears, and F5 confirms exploitation in the wild.
• Oct 31, 2023 — CISA adds both CVEs to KEV, with a November 21 federal deadline.
• Mar 21, 2024 — Mandiant attributes exploitation to UNC5174.

Vulnerability records

• CVE-2023-46747 · KEV 2023-10-31 · Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management…
• CVE-2023-46748 · KEV 2023-10-31 · An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. F5 — K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 my.f5.com
2. F5 — K000137365: BIG-IP Configuration utility authenticated SQL injection vulnerability CVE-2023-46748 my.f5.com
3. CVE record — CVE-2023-46747 cve.org
4. CVE record — CVE-2023-46748 cve.org
5. NVD — CVE-2023-46747 nvd.nist.gov
6. NVD — CVE-2023-46748 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2023-46747 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2023-46748 cisa.gov
9. Praetorian — Refresh: Compromising F5 BIG-IP With Request Smuggling (CVE-2023-46747) praetorian.com
10. Mandiant (Google Cloud) — Bringing Access Back: Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect cloud.google.com
11. F5 — Upgrade BIG-IP (software lifecycle dates) f5.com

Coverage and analysis

1. BleepingComputer — Hackers exploit recent F5 BIG-IP flaws in stealthy attacks bleepingcomputer.com
2. Help Net Security — F5 BIG-IP vulnerabilities leveraged by attackers: What to do? helpnetsecurity.com