CVE-2014-2928 in the critical feed json
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4…
published 2014-05-12 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-2950
- cvss
- 7.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 40.1%
- EPSS 40.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
Timeline
- First public exploit (Metasploit exploit/linux/http/f5_icontrol_exec)
- Published
Exploit prediction
40.05% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/linux/http/f5_icontrol_exec F5 iControl Remote Root Command Execution metasploit exploit, excellent rank, 2013-09-17
- EDB-34927 F5 iControl - Remote Command Execution (Metasploit) remote, 2014-10-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.1 | AV:N/AC:H/Au:S/C:C/I:C/A:C |
References
-
exploit-db.com
/exploits/34927
exploit
-
support.f5.com
/kb/en-us/solutions/public/15000/200/sol15220.html
vendor-advisory
-
seclists.org
/fulldisclosure/2014/May/32
mailing-list
-
osvdb.org
/106728
vdb-entry
Sources
- CVE List CVE-2014-2928
- NVD CVE-2014-2928
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.