CVE-2023-43485 : What You Need to Know

A detailed article about the BIGIP and BIG-IQ TACACS+ audit log Vulnerability CVE-2023-43485.

Understanding CVE-2023-43485

This section provides insights into the vulnerability and its impact.

What is CVE-2023-43485?

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, shared secrets are logged in plaintext in the audit log.

The Impact of CVE-2023-43485

This vulnerability can lead to a high impact on the confidentiality of sensitive information due to the exposure of shared secrets.

Technical Details of CVE-2023-43485

Explore the technical aspects of the vulnerability to understand its implications.

Vulnerability Description

The vulnerability involves the insertion of sensitive information into the log file when TACACS+ audit forwarding is enabled on BIG-IP or BIG-IQ systems.

Affected Systems and Versions

This vulnerability affects certain versions of BIG-IP and BIG-IQ, including versions 14.1.0, 15.1.0, 16.1.0, and 17.1.0 for BIG-IP, and versions 8.1.0, 8.2.0, and 8.3.0 for BIG-IQ.

Exploitation Mechanism

The exploitation involves the plaintext logging of shared secrets in the audit log when TACACS+ audit forwarding is configured.

Mitigation and Prevention

Learn how to mitigate the risks associated with CVE-2023-43485.

Immediate Steps to Take

Immediately disable TACACS+ audit forwarding on affected systems to prevent the logging of shared secrets in plaintext.

Long-Term Security Practices

Implement encryption mechanisms for sensitive information in log files and regularly update software to prevent such vulnerabilities.

Patching and Updates

Refer to the vendor advisory link provided by F5 for patches and updates to address the vulnerability.