CVE-2026-28758

Katalog CVE

CVSS 4.4 · Medium EPSS 0,11%

Kerentanan Cleartext Storage of Sensitive Information pada f5 big-ip domain name system. Skor CVSS 3.1 4.4 (Medium) menurut f5.com.

Deskripsi (NVD)

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber f5.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000158070 mitigasi · advisory vendor