CVE-2024-32049: F5 BIG-IP Information Disclosure Flaw

CVE-2024-32049 Overview

CVE-2024-32049 affects F5 BIG-IP Next Central Manager (CM) and allows an unauthenticated, remote attacker to obtain credentials for managed BIG-IP Next Local Traffic Manager (LTM) and Web Application Firewall (WAF) instances. F5 categorizes the weakness under [CWE-300] (Channel Accessible by Non-Endpoint), indicating a man-in-the-middle style exposure of sensitive authentication material. The advisory notes that software versions which have reached End of Technical Support (EoTS) are not evaluated and remain at risk. Exploitation yields direct credential disclosure for downstream LTM/WAF nodes, enabling lateral movement against the data plane that BIG-IP Next CM administers.

Critical Impact
An unauthenticated remote attacker can retrieve BIG-IP Next LTM/WAF instance credentials from Central Manager, compromising the confidentiality and integrity of managed application delivery and WAF appliances.

Affected Products

F5 BIG-IP Next Central Manager (vulnerable versions per F5 advisory K000138634)
Managed BIG-IP Next LTM instances whose credentials are stored in Central Manager
Managed BIG-IP Next WAF instances whose credentials are stored in Central Manager

Discovery Timeline

2024-05-08 - CVE-2024-32049 published to the National Vulnerability Database
2024-12-12 - Last updated in the NVD database

Technical Details for CVE-2024-32049

Vulnerability Analysis

The flaw resides in how BIG-IP Next Central Manager handles communications or storage paths that carry LTM/WAF instance credentials. An attacker positioned to reach Central Manager over the network can retrieve those credentials without authenticating to the management plane. The weakness is mapped to [CWE-300], which covers cases where a communication channel is reachable by an unintended endpoint, permitting credential interception or extraction. Successful exploitation impacts both confidentiality and integrity, since recovered credentials grant administrative access to the downstream load balancing and WAF appliances. Attack complexity is high because the attacker must reach a specific channel state, but no user interaction or prior privileges are required. EPSS modeling places the probability of near-term exploitation in the moderate range relative to other CVEs.

Root Cause

The root cause is improper protection of the channel used to transfer or expose BIG-IP Next instance credentials between Central Manager components and managed devices. F5's advisory K000138634 confirms that an unauthenticated network party can obtain these credentials, which indicates missing endpoint validation or insufficient transport protection on the affected channel.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker with access to the management network segment hosting BIG-IP Next Central Manager can interact with the exposed channel and extract LTM/WAF credentials. With those credentials, the attacker can then authenticate directly to managed instances and modify traffic policies, WAF rules, or TLS configurations. No public proof-of-concept exploit is currently catalogued, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the F5 Support Article K000138634 for vendor-confirmed technical details.

Detection Methods for CVE-2024-32049

Indicators of Compromise

Unexpected authentication events on BIG-IP Next LTM or WAF instances originating from hosts that are not authorized Central Manager components.
Configuration changes on managed instances (policy edits, certificate swaps, virtual server changes) that do not correlate with documented administrator activity.
Anomalous network sessions to BIG-IP Next Central Manager management interfaces from non-administrative source addresses.

Detection Strategies

Compare BIG-IP Next CM and managed-instance audit logs to identify credential use that did not originate from a legitimate Central Manager workflow.
Alert on any access to Central Manager management endpoints from outside the approved administrative subnet or jump-host range.
Hunt for reuse of LTM/WAF service credentials across endpoints that are not part of the BIG-IP Next control plane.

Monitoring Recommendations

Forward BIG-IP Next CM, LTM, and WAF logs to a centralized SIEM and retain them long enough to investigate slow credential-abuse chains.
Monitor egress from the management network for unexpected outbound flows that could indicate credential exfiltration.
Track service-account authentications and flag first-seen source addresses against an established baseline.

How to Mitigate CVE-2024-32049

Immediate Actions Required

Apply the fixed BIG-IP Next Central Manager version listed in F5 Support Article K000138634.
Rotate all BIG-IP Next LTM and WAF instance credentials managed by Central Manager after patching.
Restrict network reachability of the Central Manager management interface to a dedicated administrative network and jump hosts.
Audit recent administrative actions on managed LTM/WAF instances for unauthorized changes.

Patch Information

F5 has released fixed software for BIG-IP Next Central Manager. Administrators should consult F5 Support Article K000138634 for the specific fixed versions and upgrade procedure. Versions that have reached End of Technical Support are not evaluated by F5 and must be upgraded to a supported, fixed branch.

Workarounds

Place BIG-IP Next Central Manager behind strict network access controls so only known administrative hosts can reach its management services.
Enforce mutual TLS or VPN-based access to the Central Manager management plane while upgrades are scheduled.
Disable or block exposure of any Central Manager interface not required for daily operations until patching is complete.

bash

# Example: restrict access to BIG-IP Next Central Manager management interface
# Replace 10.10.10.0/24 with your authorized administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP