On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and…

Description

On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device communication between the BIG-IP ASM Central Policy Builder and the BIG-IQ/Enterprise Manager/F5 iWorkflow will be able to set up the proxy the same way and intercept the traffic.

Scores

EPSS (exploitation in 30 days)

1.1% · top 33% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

• Data injection

Affected products

• F5 · BIG-IP ASM

  • affected 15.0.0-15.0.1
  • affected 14.1.0-14.1.2
  • affected 14.0.0-14.0.1
  • affected 13.1.0-13.1.3.1

• F5 · BIG-IQ

  • affected 6.0.0
  • affected 5.2.0-5.4.0

• F5 · IWorkflow

  • affected 2.3.0

• F5 · Enterprise Manager

  • affected 3.1.1

References (1)

• https://support.f5.com/csp/article/K26462555 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-6665](https://trackcve.app/badge/CVE-2019-6665.svg)](https://trackcve.app/cve/CVE-2019-6665)

Record last updated 4 Aug 2024, 20:31 UTC.