CVE-2023-45886

7.5 highEPSS 2.0%

High (7.5). EPSS 2.0% chance of exploitation in the next 30 days.

The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
Published: 2023-11-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

f5:big-ip_global_traffic_manager
f5:big-ip_local_traffic_manager
f5:big-ip_next
f5:big-ip_next_cloud-native_network_functions
f5:big-ip_next_service_proxy_for_kubernetes
ipinfusion:zebos

References

https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling
https://my.f5.com/manage/s/article/K000137315
https://www.ipinfusion.com/doc_prod_cat/zebos/
https://www.kb.cert.org/vuls/id/347067
https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling

Check your stack JSON