← לוח פגיעויות

CVE-2026-41954

בינונית 4.9

תיאור (מקור, אנגלית)

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

מדדים

CVSS 3.1
4.9 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 4.0
6.9 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS — סבירות ניצול
0% (אחוזון 000) נכון ל-3/8/2026
CWE
CWE-200

מוצרים מושפעים

f5: big-ip access policy manager; f5: big-ip advanced firewall manager; f5: big-ip advanced web application firewall; f5: big-ip analytics; f5: big-ip application acceleration manager; f5: big-ip application security manager; f5: big-ip application visibility and reporting; f5: big-ip automation toolchain; f5: big-ip carrier-grade nat; f5: big-ip container ingress services; f5: big-ip ddos hybrid defender; f5: big-ip domain name system; f5: big-ip edge gateway; f5: big-ip fraud protection service; f5: big-ip global traffic manager

קישורים