How severe is CVE-2014-2928?

CVE-2014-2928 has a CVSS 2.0 base score of 7.1, rated high severity.

Is CVE-2014-2928 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 39% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-2928?

CVE-2014-2928 primarily affects F5 Big-ip Webaccelerator. In total, 86 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-2928?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-2928 published?

CVE-2014-2928 was published on 2014-05-12 and last updated on 2026-06-17.

CVE-2014-2928

CVE-2014-2928 is a high-severity vulnerability in F5 Big-ip Webaccelerator with a CVSS 2.0 base score of 7.1. Its EPSS exploit-prediction score of 39% places it in the 98th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: High (CVSS 2.0 base score 7.1)
EPSS exploit prediction: 39% (98th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: F5 Big-ip Webaccelerator
Published: 2014-05-12
Last modified: 2026-06-17

Description

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.

Frequently asked questions

What is CVE-2014-2928?: The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request.
How severe is CVE-2014-2928?: CVE-2014-2928 has a CVSS 2.0 base score of 7.1, rated high severity.
Is CVE-2014-2928 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 39% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-2928?: CVE-2014-2928 primarily affects F5 Big-ip Webaccelerator. In total, 86 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-2928?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2014-2928 published?: CVE-2014-2928 was published on 2014-05-12 and last updated on 2026-06-17.

References

Affected products (86)

cpe:2.3:a:f5:big-ip_webaccelerator:9.4.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.2:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.3:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.4:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.5:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.6:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.7:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:9.4.8:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.2.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.2.2:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.2.3:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:10.2.4:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.2.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.2:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.5:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.6:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.7:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:9.4.8:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.2:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.3:*:*:*:*:*:*:*

More vulnerabilities in F5 Big-ip Webaccelerator

CVE-2023-41373 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker…
CVE-2023-46747 — Critical (CVSS 9.8): Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the…
CVE-2019-6609 — Critical (CVSS 9.8): Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM,…
CVE-2018-5506 — Critical (CVSS 9.8): In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and…
CVE-2016-5022 — Critical (CVSS 9.8): F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4…
CVE-2014-7169 — Critical (CVSS 9.8): GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values…

All CVEs affecting F5 Big-ip Webaccelerator →