CVE-2024-28883: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

An origin validation vulnerability (CVE-2024-28883) was discovered in BIG-IP APM browser network access VPN client for Windows, macOS, and Linux platforms. The vulnerability was disclosed on May 8, 2024, and affects multiple versions of BIG-IP APM and APM Clients (NVD, ASEC).

The vulnerability is classified as an origin validation error (CWE-346) with a CVSS v3.1 base score of 7.4 (HIGH). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requires no privileges (PR:N), no user interaction (UI:N), and has the potential for high confidentiality and integrity impact (NVD).

The vulnerability may allow an attacker to bypass F5 endpoint inspection, potentially compromising the security of VPN connections (CVE).

The vulnerability requires network access but has high attack complexity. No public exploits or active exploitation in the wild have been reported at the time of disclosure (NVD).

F5 has released patches for affected versions: BIG-IP APM Version 17.1.1, Version 16.1.4.2, Version 15.1.10.3, and APM Clients Version 7.2.4.4. Users are advised to update to these latest versions to address the vulnerability (ASEC).