F5 BIG-IP Configuration Utility Error Message Spoofing Vulnerability

A vulnerability exists in an undisclosed BIG-IP Configuration utility page, potentially allowing an attacker to spoof error messages. This issue affects BIG-IP versions 16.1.0 to 16.1.6, 17.1.0 to 17.1.3, and all 21.x versions. The vulnerability arises from a user interface misrepresentation, where an attacker could trick authenticated BIG-IP users into clicking malicious links that reflect a fake error message in their BIG-IP Configuration utility web browser session.

Impact

Exploitation could lead to authenticated users being deceived by spoofed error messages, potentially causing confusion or misdirection during their session.

Remediation

Users can log off and close all instances of their web browser after using the BIG-IP Configuration utility. It is advised not to use the same browser for BIG-IP management and other internet activities. If both must be done on the same machine, use separate browsers.