CVE-2024-37028: F5 BIG-IP Next Central Manager Auth Bypass

CVE-2024-37028 Overview

CVE-2024-37028 is an authentication-related flaw in F5 BIG-IP Next Central Manager. An unauthenticated network-based attacker can trigger account lockouts against accounts that have never been logged in. The issue maps to [CWE-645] Overly Restrictive Account Lockout Mechanism and [CWE-287] Improper Authentication.

The vulnerability enables a targeted denial of service against management identities before those identities are ever used. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor. F5 documents the issue in the F5 Knowledge Article K000139938.

Critical Impact
An unauthenticated remote attacker can deny administrative access by locking out never-logged-in accounts on BIG-IP Next Central Manager, delaying provisioning and incident response.

Affected Products

F5 BIG-IP Next Central Manager (see vendor advisory for affected version ranges)
Deployments where administrative accounts have been provisioned but not yet used
Versions past End of Technical Support were not evaluated and should be considered at risk

Discovery Timeline

2024-08-14 - CVE-2024-37028 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37028

Vulnerability Analysis

The flaw resides in the account lockout logic of BIG-IP Next Central Manager. The system enforces failed-login thresholds against local accounts, including accounts that exist in the identity store but have never completed an initial login. An attacker can submit repeated failed authentication attempts targeting a known or guessed username. The lockout counter increments and eventually locks the account.

Because the target account has never logged in, the legitimate administrator discovers the lockout only on first use, delaying provisioning workflows and administrative access. The impact is availability of the identity, not confidentiality or integrity of data. EPSS data reflects a low probability of observed exploitation to date, but the attack requires no privileges and no user interaction.

Root Cause

The lockout mechanism does not distinguish between failed attempts on active accounts and failed attempts on dormant, never-authenticated accounts. Combined with weak protections against unauthenticated login probing, this allows external actors to weaponize the safety control itself against administrators.

Attack Vector

Exploitation is remote and unauthenticated over the management network interface exposed by BIG-IP Next Central Manager. An attacker enumerates or guesses administrative usernames and repeatedly submits invalid credentials until the lockout threshold trips. No exploit is publicly available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. The exploitation pattern is limited to repeated failed authentication requests against the Central Manager login endpoint. Refer to the F5 Knowledge Article K000139938 for authoritative technical details.

Detection Methods for CVE-2024-37028

Indicators of Compromise

Repeated failed authentication events from a single source IP against multiple usernames on the Central Manager interface
Newly provisioned administrator accounts reported as locked out on first login attempt
Bursts of HTTP POST requests to the Central Manager authentication endpoint outside normal administrative hours

Detection Strategies

Correlate authentication logs to flag high failure-to-success ratios against management planes
Alert on failed logins targeting accounts with no prior successful authentication history
Baseline expected administrator source networks and alert on failed logins from outside those ranges

Monitoring Recommendations

Ingest BIG-IP Next Central Manager audit and authentication logs into a centralized SIEM for correlation
Track lockout events per account and per source over rolling time windows
Monitor management-plane exposure and network reachability of the Central Manager UI and API

How to Mitigate CVE-2024-37028

Immediate Actions Required

Restrict network access to the BIG-IP Next Central Manager management interface to trusted administrative networks only
Apply the fixed version identified in F5 Knowledge Article K000139938
Audit provisioned administrator accounts and complete first-time logins to reduce exposure of dormant accounts
Confirm that installations past End of Technical Support are upgraded to a supported and evaluated release

Patch Information

F5 has published remediation guidance in F5 Knowledge Article K000139938. Administrators should review the affected version tables in that article and upgrade to a fixed release of BIG-IP Next Central Manager. Versions that have reached End of Technical Support were not evaluated and should be replaced.

Workarounds

Place the Central Manager management interface behind a VPN or jump host to eliminate unauthenticated internet exposure
Enforce source IP allowlists on the management network and reject authentication attempts from unexpected ranges
Rate-limit authentication requests at an upstream reverse proxy or load balancer to slow lockout abuse
Complete initial logins for all provisioned accounts and rotate any accounts that remain dormant

bash

# Example: restrict management access with iptables to an admin CIDR
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP