CVE-2012-1493 F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before...

HighCVSS 7.8 EPSS 63.0% Framework module Public exploit PoC

Published: 2012-07-10 01:00
Updated: 2026-06-17 02:39
Exploit status: Public exploit available

Description

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Affected products

Product	Affected versions	Fixed in
f5 big-ip application security manager	= 9.2.0	No fix listed
f5 big-ip application security manager	= 9.2.0-hf4	No fix listed
f5 big-ip application security manager	= 9.4.4	No fix listed
f5 big-ip application security manager	= 9.4.5	No fix listed
f5 big-ip application security manager	= 9.4.6	No fix listed
f5 big-ip application security manager	= 9.4.7	No fix listed
f5 big-ip application security manager	= 9.4.8	No fix listed
f5 big-ip application security manager	= 10.0.0	No fix listed
f5 big-ip application security manager	= 10.0.1	No fix listed
f5 big-ip application security manager	= 10.2.3-hf1	No fix listed
f5 big-ip application security manager	= 11.0.0	No fix listed
f5 big-ip application security manager	= 11.0.0-hf1	No fix listed
f5 big-ip application security manager	= 11.1.0	No fix listed
f5 big-ip application security manager	= 11.1.0-hf2	No fix listed
f5 big-ip global traffic manager	All versions	No fix listed
f5 big-ip global traffic manager	= 9.2.2	No fix listed
f5 big-ip global traffic manager	= 9.4.8-hf4	No fix listed
f5 big-ip global traffic manager	= 10.0.0	No fix listed
f5 big-ip global traffic manager	= 10.2.3-hf1	No fix listed
f5 big-ip global traffic manager	= 11.0.0	No fix listed
f5 big-ip global traffic manager	= 11.0.0-hf1	No fix listed
f5 big-ip global traffic manager	= 11.1.0	No fix listed
f5 big-ip global traffic manager	= 11.1.0-hf2	No fix listed
f5 big-ip local traffic manager	All versions	No fix listed
f5 big-ip local traffic manager	= 9.0.0	No fix listed

Show 81 more

Product	Affected versions	Fixed in
f5 big-ip local traffic manager	= 9.4.8-hf4	No fix listed
f5 big-ip local traffic manager	= 10.0.0	No fix listed
f5 big-ip local traffic manager	= 10.2.3-hf1	No fix listed
f5 big-ip local traffic manager	= 11.0.0	No fix listed
f5 big-ip local traffic manager	= 11.0.0-hf1	No fix listed
f5 big-ip local traffic manager	= 11.1.0	No fix listed
f5 big-ip local traffic manager	= 11.1.0-hf2	No fix listed
f5 tmos	All versions	No fix listed
f5 tmos	= 2.0	No fix listed
f5 tmos	= 4.0	No fix listed
f5 tmos	= 4.2	No fix listed
f5 tmos	= 4.3	No fix listed
f5 tmos	= 4.4	No fix listed
f5 tmos	= 4.5	No fix listed
f5 tmos	= 4.5.6	No fix listed
f5 tmos	= 4.5.9	No fix listed
f5 tmos	= 4.5.10	No fix listed
f5 tmos	= 4.5.11	No fix listed
f5 tmos	= 4.5.12	No fix listed
f5 tmos	= 4.6	No fix listed
f5 tmos	= 4.6.2	No fix listed
f5 tmos	= 9.0	No fix listed
f5 tmos	= 9.0.1	No fix listed
f5 tmos	= 9.0.2	No fix listed
f5 tmos	= 9.0.3	No fix listed
f5 tmos	= 9.0.4	No fix listed
f5 tmos	= 9.0.5	No fix listed
f5 tmos	= 9.1	No fix listed
f5 tmos	= 9.1.1	No fix listed
f5 tmos	= 9.1.2	No fix listed
f5 tmos	= 9.1.3	No fix listed
f5 tmos	= 9.2	No fix listed
f5 tmos	= 9.2.2	No fix listed
f5 tmos	= 9.2.3	No fix listed
f5 tmos	= 9.2.4	No fix listed
f5 tmos	= 9.2.5	No fix listed
f5 tmos	= 9.3	No fix listed
f5 tmos	= 9.3.1	No fix listed
f5 tmos	= 9.4	No fix listed
f5 tmos	= 9.4.1	No fix listed
f5 tmos	= 9.4.2	No fix listed
f5 tmos	= 9.4.3	No fix listed
f5 tmos	= 9.4.4	No fix listed
f5 tmos	= 9.4.5	No fix listed
f5 tmos	= 9.4.6	No fix listed
f5 tmos	= 9.4.7	No fix listed
f5 tmos	= 9.4.8	No fix listed
f5 tmos	= 9.6.0	No fix listed
f5 tmos	= 9.6.1	No fix listed
f5 tmos	= 10.0.0	No fix listed
f5 tmos	= 10.0.1	No fix listed
f5 tmos	= 10.1.0	No fix listed
f5 tmos	= 10.2.0	No fix listed
f5 big-ip 1000	All versions	No fix listed
f5 big-ip 11000	All versions	No fix listed
f5 big-ip 11050	All versions	No fix listed
f5 big-ip 1500	All versions	No fix listed
f5 big-ip 1600	All versions	No fix listed
f5 big-ip 2400	All versions	No fix listed
f5 big-ip 3400	All versions	No fix listed
f5 big-ip 3410	All versions	No fix listed
f5 big-ip 3600	All versions	No fix listed
f5 big-ip 3900	All versions	No fix listed
f5 big-ip 4100	All versions	No fix listed
f5 big-ip 5100	All versions	No fix listed
f5 big-ip 5110	All versions	No fix listed
f5 big-ip 6400	All versions	No fix listed
f5 big-ip 6800	All versions	No fix listed
f5 big-ip 6900	All versions	No fix listed
f5 big-ip 8400	All versions	No fix listed
f5 big-ip 8800	All versions	No fix listed
f5 big-ip 8900	All versions	No fix listed
f5 big-ip 8950	All versions	No fix listed
f5 enterprise manager	All versions	No fix listed
f5 enterprise manager	= 1.0	No fix listed
f5 enterprise manager	= 2.0	No fix listed
f5 enterprise manager	= 2.1.0	No fix listed
f5 enterprise manager	= 2.1.0-hf1	No fix listed
f5 enterprise manager	= 2.2.0	No fix listed
f5 enterprise manager	= 2.3.0	No fix listed
f5 enterprise manager	= 2.3.0-hf2	No fix listed

References

CVSS v2.0

7.8 High

AV:N/AC:L/Au:N/C:C/I:N/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 62.98% (percentile 99.2)
CWE: CWE-255

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

F5 BIG-IP SSH Private Key Exposure Framework module · Metasploit Framework (Rapid7) · 2012-06-11
F5 BIG-IP - Authentication Bypass Exploit · Exploit Database (OffSec) · 2012-06-12
F5 BIG-IP - SSH Private Key Exposure (Metasploit) Exploit · Exploit Database (OffSec) · 2012-06-13
F5 BIG-IP - Authentication Bypass (PoC) PoC · Exploit Database (OffSec) · 2012-06-11