CVE-2014-3959: Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, An...

Security readout for executives and security teams

CVE-2014-3959 is a cross-site scripting flaw in the F5 Configuration utility. If an attacker can reach the affected interface, they may be able to inject script or HTML into list.jsp. The public bundle does not provide CVSS, fixed versions, or exploit evidence. Exposure is most likely where affected F5 management or Configuration utility interfaces are reachable by untrusted users. Internet-exposed management planes, shared admin networks, or weak administrative access controls would raise business risk. Treat this as a management-plane hygiene issue with moderate urgency. Prioritize systems where F5 administrative interfaces are exposed beyond trusted operators, then confirm vendor remediation because the public record lacks full fix details. Mitigation focus: Inventory F5 products and versions against the affected ranges listed in the CVE.; Review F5 advisory SOL15296 for fixed versions and vendor-approved remediation.; Restrict Configuration utility access to trusted administrative networks only..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.