title: BIG-IP Edge Client for Windows vulnerability
description: On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
defaultStatus: unknown
platforms: Windows
product: APM Clients
vendor: F5
versions:
lessThan: 7.2.3.1, status: affected, version: 7.1.5, versionType: semver
lessThan: *, status: unaffected, version: 7.2.4, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL