---
title: "F5 BIG-IP CVE-2023-46747/46748: TMUI Auth Bypass to RCE"
url: https://erroneo.us/security/briefs/f5-big-ip-cve-2023-46747-46748-tmui-auth-bypass-rce/
description: "Unauthenticated RCE in the BIG-IP Configuration utility, chained with a SQL injection and exploited since Oct 2023. Hotfixed. Check exposure and hunt."
type: security-brief
section: "Security Digest"
date_published: 2023-10-26
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-46747", "CVE-2023-46748"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# F5 BIG-IP CVE-2023-46747/46748: TMUI Auth Bypass to RCE

**Verdict: Check exposure.** Fixes shipped in October 2023, so the job now is to prove no BIG-IP still exposes its Configuration utility on an unfixed build, and to hunt for the backdoor accounts attackers left behind.

- **Who must act:** Owners of BIG-IP 13.1, 14.1, 15.1, 16.1 or 17.1 systems whose Configuration utility (TMUI) was reachable from untrusted networks via the management port or self IPs, especially any never upgraded or hotfixed.
- **Who can relax:** Teams that applied F5's hotfix or a later fixed release in late 2023, keep TMUI on an isolated management network with self-IP port lockdown, and found no rogue admin accounts.
- **Affected:** BIG-IP 17.1.0 through 17.1.x without the fix; BIG-IP 16.1.0 through 16.1.x without the fix; BIG-IP 15.1.0 through 15.1.x without the fix; BIG-IP 14.1.0 through 14.1.x without the fix; BIG-IP 13.1.0 through 13.1.x without the fix
- **Fixed:** Hotfix-BIGIP-17.1.1.0.2.6-ENG and Hotfix-BIGIP-17.1.0.3.0.75.4-ENG; Hotfix-BIGIP-16.1.4.1.0.50.5-ENG; Hotfix-BIGIP-15.1.10.2.0.44.2-ENG; Hotfix-BIGIP-14.1.5.6.0.10.6-ENG; Hotfix-BIGIP-13.1.5.1.0.20.2-ENG; Later fixed releases on supported branches, per F5's advisories
- **CVEs:** CVE-2023-46747, CVE-2023-46748
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every BIG-IP and record its version and hotfix with tmsh show sys version.
2. Move anything still on 13.1, 14.1, 15.1 or 16.1 to a supported branch such as 17.1 or later, since those branches no longer receive fixes.
3. Confirm the TMUI is reachable only from a dedicated management network: check tmsh list sys httpd allow and set self-IP port lockdown so no self IP serves the Configuration utility.
4. List local users with tmsh list auth user and remove any account you cannot account for, then rotate admin passwords and keys.
5. Treat any device that was internet-exposed on an unfixed build in late 2023 as compromised: rebuild it and rotate stored secrets rather than cleaning it in place.

### How to check if you are affected

- Search /var/log/audit for tmsh create auth user commands and for run util bash by unfamiliar accounts such as f5support3, F5_admin or f5_support.
- Search /var/log/restjavad-audit.log for POST requests to /mgmt/tm/util/bash from unexpected users or source IPs.
- Grep /var/log/tomcat/catalina.out for java.sql.SQLException: Column not found followed by sh: no job control in this shell, the CVE-2023-46748 indicator F5 published.
- Look for unexpected ELF files in /tmp (for example /tmp/watchsys) and for new home directories under /home.

## What happened

On October 26, 2023, F5 published two flaws in the BIG-IP Configuration utility, the web admin interface also called TMUI. [CVE-2023-46747](https://www.cve.org/CVERecord?id=CVE-2023-46747) lets "undisclosed requests" bypass authentication, so an unauthenticated attacker who can reach the utility can run arbitrary system commands. F5 scores it CVSS 3.1 9.8. [CVE-2023-46748](https://www.cve.org/CVERecord?id=CVE-2023-46748) is an authenticated SQL injection in the same utility that also leads to command execution, scored 8.8.

Praetorian's Thomas Hendrickson and Michael Weber found the first bug and reported it to F5 on October 5. Their [write-up](https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/) describes Apache JServ Protocol (AJP) request smuggling, closely related to CVE-2022-26377. A smuggled request creates an administrator account, and that account then runs bash through the REST API. A public proof of concept followed on October 30. The same day, F5 updated both advisories to warn of active exploitation in the wild, with the two bugs used together, as [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-recent-f5-big-ip-flaws-in-stealthy-attacks/) and [Help Net Security](https://www.helpnetsecurity.com/2023/11/02/cve-2023-46747-cve-2023-46748-exploited/) reported. CISA added both to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747) on October 31 and flags CVE-2023-46747 as known to be used in ransomware campaigns.

In March 2024, [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect) attributed late-October 2023 exploitation to UNC5174. It describes the group as a suspected China-nexus actor that tried to sell access to US defense contractor appliances and UK government entities. After creating backdoor admins, the group ran F5's own mitigation script to lock out rival attackers.

## Who is affected

The affected branches are BIG-IP 13.1, 14.1, 15.1, 16.1 and 17.1, when the utility is reachable through the management port or a self IP. F5 shipped engineering hotfixes, listed in the CVE record and in advisories [K000137353](https://my.f5.com/manage/s/article/K000137353) and [K000137365](https://my.f5.com/manage/s/article/K000137365), for example Hotfix-BIGIP-17.1.1.0.2.6-ENG and Hotfix-BIGIP-15.1.10.2.0.44.2-ENG. According to F5's [lifecycle page](https://www.f5.com/products/big-ip-upgrade), BIG-IP 15.x reached end of technical support on December 31, 2024 and 16.1 on July 31, 2025. Of the affected branches, only 17.1 still gets fixes.

## Do you really need to act?

Most teams patched this in 2023. The risk today sits in two places. One is forgotten or end-of-life BIG-IPs that never took the hotfix and still expose TMUI, especially through a self IP on a public VLAN. The other is devices that were exploited in the window and still carry attacker accounts. Patching and the mitigation script do not remove accounts already created, and Mandiant saw attackers apply that script themselves. So "it shows as mitigated" does not prove "it is clean." F5 told customers that when there is any uncertainty, they should consider the device compromised.

## What to do now

1. Run `tmsh show sys version` on every BIG-IP and confirm the build includes the fix.
2. Upgrade anything on 13.1 through 16.1 to a supported branch, 17.1 or later.
3. Check `tmsh list sys httpd allow` and the self-IP `allow-service` settings (`tmsh list net self all-properties`). No self IP should serve the utility, and management access should come only from an admin network.
4. Review `tmsh list auth user`, delete unknown accounts, and rotate admin credentials.
5. Rebuild any device that was exposed and unfixed in late 2023, and rotate the certificates and secrets stored on it.

## How to tell if you were hit

Search `/var/log/audit` for `create auth user` and `run util bash`. Search `/var/log/restjavad-audit.log` for POSTs to `/mgmt/tm/util/bash`. Mandiant documented accounts named `f5support3`, `F5_admin` and `f5_support`, plus a downloader dropped at `/tmp/watchsys`. For the SQL injection, F5's published indicator is `java.sql.SQLException: Column not found: 0.` followed by `sh: no job control in this shell` in `/var/log/tomcat/catalina.out`. Logs rotate, so an empty result on a device exposed in 2023 proves little.

## Timeline

- Oct 5, 2023 — Praetorian reports CVE-2023-46747 to F5.
- Oct 26, 2023 — F5 publishes both advisories with engineering hotfixes.
- Oct 30, 2023 — A public proof of concept appears, and F5 confirms exploitation in the wild.
- Oct 31, 2023 — CISA adds both CVEs to KEV, with a November 21 federal deadline.
- Mar 21, 2024 — Mandiant attributes exploitation to UNC5174.

## Sources

1. [F5 — K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747](https://my.f5.com/manage/s/article/K000137353)
2. [F5 — K000137365: BIG-IP Configuration utility authenticated SQL injection vulnerability CVE-2023-46748](https://my.f5.com/manage/s/article/K000137365)
3. [CVE record — CVE-2023-46747](https://www.cve.org/CVERecord?id=CVE-2023-46747)
4. [CVE record — CVE-2023-46748](https://www.cve.org/CVERecord?id=CVE-2023-46748)
5. [NVD — CVE-2023-46747](https://nvd.nist.gov/vuln/detail/CVE-2023-46747)
6. [NVD — CVE-2023-46748](https://nvd.nist.gov/vuln/detail/CVE-2023-46748)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-46747](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747)
8. [CISA — Known Exploited Vulnerabilities: CVE-2023-46748](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748)
9. [Praetorian — Refresh: Compromising F5 BIG-IP With Request Smuggling (CVE-2023-46747)](https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/)
10. [Mandiant (Google Cloud) — Bringing Access Back: Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect](https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect)
11. [F5 — Upgrade BIG-IP (software lifecycle dates)](https://www.f5.com/products/big-ip-upgrade)
12. [BleepingComputer — Hackers exploit recent F5 BIG-IP flaws in stealthy attacks](https://www.bleepingcomputer.com/news/security/hackers-exploit-recent-f5-big-ip-flaws-in-stealthy-attacks/)
13. [Help Net Security — F5 BIG-IP vulnerabilities leveraged by attackers: What to do?](https://www.helpnetsecurity.com/2023/11/02/cve-2023-46747-cve-2023-46748-exploited/)

---
Source page: https://erroneo.us/security/briefs/f5-big-ip-cve-2023-46747-46748-tmui-auth-bypass-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt