CVE-2024-37028
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.45%
- CWE
- CWE-645
- Published
- 2024-08-14
- Last modified
- 2026-03-13
Affected products
- F5 BIG-IP Next Central Manager
Weakness type
Related vulnerabilities
- CVE-2026-53982 — Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association
- CVE-2026-25907 — Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism...
- CVE-2025-5241 — Denial-of-Service Vulnerability in MELSEC iQ-F Series
- CVE-2025-31947 — Repeated LDAP login failures can lock an LDAP account
- CVE-2024-1722 — Keycloak-core: dos via account lockout
- CVE-2023-4346