CVE-2014-2927

State: Published
Severity: Not scored
Published: Oct 15, 2014
Updated: Aug 6, 2024
Reserved: Apr 21, 2014

Description

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html
http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf
34465exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.