CVE-2020-5860

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.2 through 15.1.0.2 BIG-IQ versions 5.2.0 through 7.0.0

Description The failover service in a High Availability (HA) network failover in Device Service Cluster (DSC) does not require a strong form of authentication. Additionally, HA network failover traffic is not encrypted by Transport Layer Security (TLS).

Recommendations For BIG-IP versions 11.5.2 through 15.1.0.2, consider implementing strong authentication for the failover service and enabling Transport Layer Security (TLS) encryption for HA network failover traffic. For BIG-IQ versions 5.2.0 through 7.0.0, consider implementing strong authentication for the failover service and enabling Transport Layer Security (TLS) encryption for HA network failover traffic. At the moment, there is no information about a newer version that contains a fix for this vulnerability.