dbcve.org
Big Ip Local Traffic ManagerApplication · F5

CVE-2019-6609

CRITICAL · 9.8 CVSS v3.0 Published 2019-04-15
Fix available
A fix is available. Upgrade to 12.1.4.1 / 13.1.1.4 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

On iSeries platforms, the secureKeyCapable attribute was not set in BIG-IP versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, causing secure vault to bypass F5 hardware support and store the unit key in plaintext on disk instead. This plaintext key is also included in UCS backup files, creating a critical exposure vector.

MitigationUpgrade BIG-IP on iSeries platforms to a version beyond the affected ranges (14.1.0.2+, 13.1.1.4+, or 12.1.5+) to enable proper hardware-backed key storage, then rotate unit keys and treat UCS backup files as sensitive until remediated.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Big Ip Local Traffic ManagerApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Application Acceleration ManagerApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Advanced Firewall ManagerApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip AnalyticsApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Access Policy ManagerApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Application Security ManagerApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Domain Name SystemApplication
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1
Big Ip Edge GatewayWeb browser
Affected:>= 12.1.2, < 12.1.4.1>= 13.0.0, < 13.1.1.4>= 14.0.0, < 14.1.0.2= 12.1.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify platform type
    Run command 'tmsh show sys hardware' or check system inventory to confirm the device is an F5 iSeries platform (e.g., i2000, i4000, i5000, i7000 series).
    Affected if The device is NOT an iSeries platform - the vulnerability only affects iSeries hardware.
  2. Determine installed BIG-IP version
    Run 'tmsh show sys version' or check /etc/version to obtain the installed BIG-IP version number.
    Affected if The installed version falls within these ranges: 12.1.1, 12.1.2-12.1.4, 13.0.0-13.1.1.3, or 14.0.0-14.1.0.1.
  3. Check secure vault configuration
    Run 'tmsh list sys crypto secure-vault' to inspect the secure vault settings. Look for the 'secureKeyCapable' attribute status.
    Affected if The secureKeyCapable attribute is missing or set to 'no', indicating hardware-backed key storage is not enabled.
  4. Inspect unit key storage
    Locate and examine the unit key file in the secure vault storage directory (typically under /var/config/restjavad/vaultee/ or similar vault storage path). View the file contents to determine if the key appears in plaintext.
    Affected if The unit key file exists and contains plaintext key material instead of being hardware-encrypted or referenced as hardware-backed.

A user is affected if they are running an iSeries platform with a BIG-IP version in the 12.1.1, 12.1.2-12.1.4, 13.0.0-13.1.1.3, or 14.0.0-14.1.0.1 range AND the secureKeyCapable attribute is not set, resulting in plaintext unit key storage on disk or in UCS backups.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 12.1.4.1 / 13.1.1.4 / 14.1.0.2 or later
Fixed in 12.1.4.113.1.1.414.1.0.2
Interim mitigation

Upgrade BIG-IP on iSeries platforms to a version beyond the affected ranges (14.1.0.2+, 13.1.1.4+, or 12.1.5+) to enable proper hardware-backed key storage, then rotate unit keys and treat UCS backup files as sensitive until remediated.

Recommended fix High confidence

Upgrade to minimum fixed version based on current branch: 12.1.4.1+ (12.1.5/12.1.6 LTS), 13.1.1.4+ (13.1.3 LTS), or 14.1.0.2+ (14.1.x LTS)

  1. 1. Identify the current BIG-IP version by running 'tmsh show sys version' in the TMSH CLI
  2. 2. Determine if the device is an iSeries platform by running 'tmsh show sys hardware' and checking the platform model
  3. 3. For BIG-IP 12.1.x: Upgrade to version 12.1.4.1 or later (recommended: 12.1.5 LTS or 12.1.6 if available)
  4. 4. For BIG-IP 13.0.x-13.1.x: Upgrade to version 13.1.1.4 or later (recommended: 13.1.3 LTS or 14.1.x if planning major version change)
  5. 5. For BIG-IP 14.0.x: Upgrade to version 14.1.0.2 or later (recommended: 14.1.x LTS)
  6. 6. After upgrade, verify the secureKeyCapable attribute is properly set by checking secure vault status: 'tmsh list sys secure-vault'
  7. 7. For existing UCS archive files taken on iSeries platforms before the fix, regenerate new UCS archives after patching to ensure credentials are properly protected
  8. 8. If upgrade is not immediately possible, restrict physical and administrative access to the BIG-IP system and ensure UCS files are stored securely with additional encryption
Caveat This is a security-only fix with minimal breaking changes; however, always test in non-production environment first as with any upgrade; note iSeries platform is required for this vulnerability to be exploitable

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Big Ip Local Traffic Manager Scoped from the published advisory
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing8.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,800
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,080.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2019-6609 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2019-6609 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data