How severe is CVE-2015-4637?

CVE-2015-4637 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2015-4637 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-4637?

CVE-2015-4637 primarily affects F5 Big-iq Adc. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-4637?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-4637 published?

CVE-2015-4637 was published on 2015-07-16 and last updated on 2026-06-17.

CVE-2015-4637

CVE-2015-4637 is a medium-severity vulnerability in F5 Big-iq Adc with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-17.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 1% (63rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-17
Affected product: F5 Big-iq Adc
Published: 2015-07-16
Last modified: 2026-06-17

Description

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.

Frequently asked questions

What is CVE-2015-4637?: The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.
How severe is CVE-2015-4637?: CVE-2015-4637 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2015-4637 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-4637?: CVE-2015-4637 primarily affects F5 Big-iq Adc. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-4637?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-4637 published?: CVE-2015-4637 was published on 2015-07-16 and last updated on 2026-06-17.

References

https://support.f5.com/kb/en-us/solutions/public/16000/800/sol16861.html

Affected products (7)

cpe:2.3:a:f5:big-iq_adc:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_cloud:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_cloud:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_device:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_device:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_security:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-iq_security:4.5.0:*:*:*:*:*:*:*

More vulnerabilities in F5 Big-iq Adc

CVE-2015-3628 — Critical (CVSS 9.0): The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and…
CVE-2015-7394 — Critical (CVSS 9.0): The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM…
CVE-2015-5058 — High (CVSS 7.8): Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and…
CVE-2015-4047 — High (CVSS 7.8): racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and…
CVE-2014-0101 — High (CVSS 7.8): The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain…
CVE-2014-5209 — Medium (CVSS 5.3): An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control…

All CVEs affecting F5 Big-iq Adc →

Other CWE-17 vulnerabilities

CVE-2015-5887 — Critical (CVSS 10.0): The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request…
CVE-2015-2738 — Critical (CVSS 10.0): The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before…
CVE-2015-2737 — Critical (CVSS 10.0): The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR…
CVE-2015-2734 — Critical (CVSS 10.0): The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0,…
CVE-2015-4335 — Critical (CVSS 10.0): Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CVE-2015-3292 — Critical (CVSS 10.0): The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging…

Browse all CWE-17 vulnerabilities →