F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manag…

published 2012-07-09 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-1511

cvss: 7.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 63.3%; EPSS 63.3% chance of exploitation in 30 days, percentile 99.2%
public exploits: 4; Metasploit, Exploit-DB

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Patch / fix

links 1

github.com/rapid7/metasploit-framework/blob/master/modules/exploits/l… patch

Timeline

2012-06-11 First public exploit (Metasploit exploit/linux/ssh/f5_bigip_known_privkey)
2012-07-09 Published

Exploit prediction

63.33% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/ssh/f5_bigip_known_privkey F5 BIG-IP SSH Private Key Exposure metasploit exploit, excellent rank, 2012-06-11
EDB-19099 F5 BIG-IP - SSH Private Key Exposure (Metasploit) remote, 2012-06-13
EDB-19091 F5 BIG-IP - Authentication Bypass remote, 2012-06-12
EDB-19064 F5 BIG-IP - Authentication Bypass (PoC) dos, 2012-06-11

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:C/I:N/A:N

Classification

Weakness

CWE-255 Credentials Management Errors

References

Sources

CVE List CVE-2012-1493
NVD CVE-2012-1493

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary