big-ip next central manager vulnerabilities and fixes

Recent CVEs affecting big-ip next central manager, with upgrade or downgrade steps. 5 tracked.

Also searched as: big ip next central manager, big-ipnextcentralmanager.

big-ip next central manager has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-02-05. Highest priority: CVE-2024-39809 (score 36/100).

• CVE-2025-24319 MEDIUM 6.5 UPGRADE When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can c
• CVE-2025-23413 MEDIUM 4.4 UPGRADE When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sen
• CVE-2024-41719 MEDIUM 4.2 UPGRADE When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credenti
• CVE-2024-39809 HIGH 7.5 DOWNGRADE The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions
• CVE-2024-37028 MEDIUM 5.3 UPGRADE BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note:

FAQ

How do I fix big-ip next central manager vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is big-ip next central manager being exploited right now?

None of the tracked big-ip next central manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which big-ip next central manager CVE should I patch first?

CVE-2024-39809 currently ranks highest (36/100): The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions .

RSS feed for big-ip next central manager · ← Back to latest CVEs