{"uuid": "4fb7fcce-4950-4092-a0c1-c248b5558fa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23033", "type": "seen", "source": "https://t.me/hacking_Attack/21600", "content": "Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets The Other Dozen BugsBesides the critical CVE-2021-23031 flaw, the dozen high-severity security bugs addressed in this month\u2019s patch release and listed in the table below have risk scores of between 7.2 and 7.5. The flaws include authenticated remote command execution (RCE), cross-site scripting (XSS) and request forgery, as well as insufficient permission and denial-of-service (DOS).\n\nHalf of them affect all modules, five impact the Advanced WAF and ASM, and one affects the DNS module.\n\nCVE / Bug ID Severity CVSS score Affected products Affected versions Fixes introduced in CVE-2021-23025 High 7.2 BIG-IP (all modules) 15.0.0 \u2013 15.1.0\n14.1.0 \u2013 14.1.3\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.0.0\n15.1.0.5\n14.1.3.1\n13.1.3.5 CVE-2021-23026 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.2\n13.1.4.1 BIG-IQ 8.0.0 \u2013 8.1.0\n7.0.0 \u2013 7.1.0\n6.0.0 \u2013 6.1.0 None CVE-2021-23027 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3 CVE-2021-23028 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.2\n13.1.4 CVE-2021-23029 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23030 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n16.0.1.2\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23031 High\n\n \n\u2014\n\nCritical \u2013 Appliance mode only\n8.8\n\n \n\u2014\n\n9.9\nBIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.2\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.3\n12.1.0 \u2013 12.1.5\n11.6.1 \u2013 11.6.5 16.1.0\n16.0.1.2\n15.1.3\n14.1.4.1\n13.1.4\n12.1.6\n11.6.5.3 CVE-2021-23032 High 7.5 BIG-IP (DNS) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.4 CVE-2021-23033 High 7.5 BIG-IP (Advanced WAF, ASM) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6 16.1.0\n15.1.3.1\n14.1.4.3\n13.1.4.1 CVE-2021-23034 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.0.1\n15.1.0 \u2013 15.1.3 16.1.0\n15.1.3.1 CVE-2021-23035 High 7.5 BIG-IP (all modules) 14.1.0 \u2013 14.1.4 14.1.4.4 CVE-2021-23036 High 7.5 BIG-IP (Advanced WAF, ASM, DataSafe) 16.0.0 \u2013 16.0.1 16.1.0\n16.0.1.2 CVE-2021-23037 High 7.5 BIG-IP (all modules) 16.0.0 \u2013 16.1.0\n15.1.0 \u2013 15.1.3\n14.1.0 \u2013 14.1.4\n13.1.0 \u2013 13.1.4\n12.1.0 \u2013 12.1.6\n11.6.1 \u2013 11.6.5 None CISA Security AdvisoryThe Cybersecurity and Infrastructure Security Agency (CISA) issued a security advisory\u00a0encouraging users and admins to review F5\u2019s security advisory\u00a0and to update the software or to apply mitigations ASAP.\n\n\u201cDon\u2019t delay\u201d is, of course, good advice when it comes to F5 equipment, given that the company\u2019s enterprise networking can be found in some of the largest tech companies in the world, including Facebook, Microsoft and Oracle. It\u2019s also found in the halls of a trove of Fortune 500 companies, including some of the world\u2019s biggest financial institutions and ISPs.\nSee Also: Offensive Security Tool: FFUF F5: Prime Pickings for PestsAll that gear is also gleefully picked apart by attackers. Case in point: CVE 2020-5902, a critical vulnerability in F5 Networks\u2019 BIG-IP advanced delivery controller networking devices that, as of July 2020, was being exploited by attackers to scrape credentials, launch malware and more, was recently featured in CISA\u2019s list of top 30 bugs\u00a0\u201croutinely\u201d exploited in 2020 and into this year.\n\nJonathan Chua, application security consultant at app security provider nVisium, noted that F5 Big IP has been targeted by security researchers and adversaries due to the product\u2019s vulnerable, external nature. \u201cSeveral F5 application services can be hosted externally, allowing[...]", "creation_timestamp": "2026-09-01T20:02:26.332827Z"}