Improper Authentication in F5 BIG-IP Edge Client for Windows
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2020-5855 |
| CWE-ID | CWE-287 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
BIG-IP APM Hardware solutions / Security hardware applicances APM Clients Hardware solutions / Security hardware applicances |
| Vendor | F5 Networks |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Improper Authentication
EUVDB-ID: #VU25003
Risk: Low
CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]
CVE-ID: CVE-2020-5855
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to an error when the Windows Logon Integration feature is configured for BIG-IP Edge Client. An attacker with physical access to an authorized user's machine can bypass authentication to gain unauthorized access to internal resources or compromise the availability of the resources.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsBIG-IP APM: 11.5.2 - 15.1.0
APM Clients: 7.1.5 - 7.1.8
External linkshttp://support.f5.com/csp/article/K55102004
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
