CVE-2023-22657

F5OS vulnerability

High7.0EPSS 0.44%

Published: 1 Feb 2023
Updated: 26 Mar 2025
Reserved: 13 Jan 2023
Assigned by: f5

Description

On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS scores of CVE-2023-22657, by who scored it
Scored by	CVSS	Score	Vector
f5CNA (assigner)	3.1	High7.0	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.44% · top 61% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (opens in a new tab)All about CWE-77 and its CVEs

Affected products

F5 · F5OS-A
- affected 1.2.0 – < 1.3.0
F5 · F5OS-C
- affected 1.3.0 – < 1.5.0

References (1)

https://my.f5.com/manage/s/article/K06345931 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-22657](https://trackcve.app/badge/CVE-2023-22657.svg)](https://trackcve.app/cve/CVE-2023-22657)

Record last updated 26 Mar 2025, 17:49 UTC.