Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2023-10-26

CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

  1. First PoC
  2. 777 days →Metasploit
  3. 304 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2023-10-31 · due 2023-11-21 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
97%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

10 known · links only

GitHub PoCs · by trust, then stars8

  1. W01fh4cker/CVE-2023-46747-RCE ↗Trust ok 100

    exploit for f5-big-ip RCE cve-2023-46747

    ★ 205 · created 2023-11-01

  2. nvansluis/test_cve-2023-46747 ↗Trust ok 100

    ★ 7 · created 2023-11-02

  3. Razzlemouse/F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit ↗Trust ok 100

    #F5-BIG-IP-CVE-2023-46747-Exploit – Unauthenticated RCE Python exploit & Nuclei template by Raguraman ✓ Automated TCP reverse shell (LHOST/LPORT) ✓ Tested on affected BIG-IP 13.x–17.x ⚠️ Authorized pentesting only

    ★ 4 · created 2025-12-03

  4. RevoltSecurities/CVE-2023-46747 ↗Trust ok 100

    An Exploitation script developed to exploit the CVE-2023-46747 which Pre Auth Remote Code Execution of f5-BIG Ip producs

    ★ 3 · created 2023-11-03

  5. maniak-academy/Mitigate-CVE-2023-46747 ↗Trust ok 100

    ★ 2 · created 2023-11-01

  6. vidura2/cve-2023-46747 ↗Trust ok 100

    ★ 2 · created 2024-02-11

  7. cediegreyhat/BigFinger ↗Trust ok 100

    CVE-2023-46747-RCE PoC

    ★ 0 · created 2025-07-04

  8. fu2x2000/CVE-2023-46747 ↗Trust ok 100

    CVE-2023-46747 Criticle Auth Bypass

    ★ 0 · created 2023-11-01

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. F5 BIG-IP TMUI AJP Smuggling RCE ↗

    This module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMUI) that enables an external, unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new account to execute a command payload. Both the exploit and check methods automatically delete any temporary accounts that are created.

    ruby · seen 2026-10-18

Nuclei1

  1. F5 BIG-IP - Unauthenticated RCE via AJP Smuggling ↗

    CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.