Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Published

2022-05-05T17:15:10.570

Last Modified

2025-04-02T18:17:58.003

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-306
Type: Primary
CWE-306

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	f5	big-ip_access_policy_manager	≤ 11.6.5	Yes
Application	f5	big-ip_access_policy_manager	≤ 12.1.6	Yes
Application	f5	big-ip_access_policy_manager	< 13.1.5	Yes
Application	f5	big-ip_access_policy_manager	< 14.1.4.6	Yes
Application	f5	big-ip_access_policy_manager	< 15.1.5.1	Yes
Application	f5	big-ip_access_policy_manager	< 16.1.2.2	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 11.6.5	Yes
Application	f5	big-ip_advanced_firewall_manager	≤ 12.1.6	Yes
Application	f5	big-ip_advanced_firewall_manager	< 13.1.5	Yes
Application	f5	big-ip_advanced_firewall_manager	< 14.1.4.6	Yes
Application	f5	big-ip_advanced_firewall_manager	< 15.1.5.1	Yes
Application	f5	big-ip_advanced_firewall_manager	< 16.1.2.2	Yes
Application	f5	big-ip_analytics	≤ 11.6.5	Yes
Application	f5	big-ip_analytics	≤ 12.1.6	Yes
Application	f5	big-ip_analytics	< 13.1.5	Yes
Application	f5	big-ip_analytics	< 14.1.4.6	Yes
Application	f5	big-ip_analytics	< 15.1.5.1	Yes
Application	f5	big-ip_analytics	< 16.1.2.2	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 11.6.5	Yes
Application	f5	big-ip_application_acceleration_manager	≤ 12.1.6	Yes
Application	f5	big-ip_application_acceleration_manager	< 13.1.5	Yes
Application	f5	big-ip_application_acceleration_manager	< 14.1.4.6	Yes
Application	f5	big-ip_application_acceleration_manager	< 15.1.5.1	Yes
Application	f5	big-ip_application_acceleration_manager	< 16.1.2.2	Yes
Application	f5	big-ip_application_security_manager	≤ 11.6.5	Yes
Application	f5	big-ip_application_security_manager	≤ 12.1.6	Yes
Application	f5	big-ip_application_security_manager	< 13.1.5	Yes
Application	f5	big-ip_application_security_manager	< 14.1.4.6	Yes
Application	f5	big-ip_application_security_manager	< 15.1.5.1	Yes
Application	f5	big-ip_application_security_manager	< 16.1.2.2	Yes
Application	f5	big-ip_domain_name_system	≤ 11.6.5	Yes
Application	f5	big-ip_domain_name_system	≤ 12.1.6	Yes
Application	f5	big-ip_domain_name_system	< 13.1.5	Yes
Application	f5	big-ip_domain_name_system	< 14.1.4.6	Yes
Application	f5	big-ip_domain_name_system	< 15.1.5.1	Yes
Application	f5	big-ip_domain_name_system	< 16.1.2.2	Yes
Application	f5	big-ip_fraud_protection_service	≤ 11.6.5	Yes
Application	f5	big-ip_fraud_protection_service	≤ 12.1.6	Yes
Application	f5	big-ip_fraud_protection_service	< 13.1.5	Yes
Application	f5	big-ip_fraud_protection_service	< 14.1.4.6	Yes
Application	f5	big-ip_fraud_protection_service	< 15.1.5.1	Yes
Application	f5	big-ip_fraud_protection_service	< 16.1.2.2	Yes
Application	f5	big-ip_global_traffic_manager	≤ 11.6.5	Yes
Application	f5	big-ip_global_traffic_manager	≤ 12.1.6	Yes
Application	f5	big-ip_global_traffic_manager	< 13.1.5	Yes
Application	f5	big-ip_global_traffic_manager	< 14.1.4.6	Yes
Application	f5	big-ip_global_traffic_manager	< 15.1.5.1	Yes
Application	f5	big-ip_global_traffic_manager	< 16.1.2.2	Yes
Application	f5	big-ip_link_controller	≤ 11.6.5	Yes
Application	f5	big-ip_link_controller	≤ 12.1.6	Yes
Application	f5	big-ip_link_controller	< 13.1.5	Yes
Application	f5	big-ip_link_controller	< 14.1.4.6	Yes
Application	f5	big-ip_link_controller	< 15.1.5.1	Yes
Application	f5	big-ip_link_controller	< 16.1.2.2	Yes
Application	f5	big-ip_local_traffic_manager	≤ 11.6.5	Yes
Application	f5	big-ip_local_traffic_manager	≤ 12.1.6	Yes
Application	f5	big-ip_local_traffic_manager	< 13.1.5	Yes
Application	f5	big-ip_local_traffic_manager	< 14.1.4.6	Yes
Application	f5	big-ip_local_traffic_manager	< 15.1.5.1	Yes
Application	f5	big-ip_local_traffic_manager	< 16.1.2.2	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 11.6.5	Yes
Application	f5	big-ip_policy_enforcement_manager	≤ 12.1.6	Yes
Application	f5	big-ip_policy_enforcement_manager	< 13.1.5	Yes
Application	f5	big-ip_policy_enforcement_manager	< 14.1.4.6	Yes
Application	f5	big-ip_policy_enforcement_manager	< 15.1.5.1	Yes
Application	f5	big-ip_policy_enforcement_manager	< 16.1.2.2	Yes

References

http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://support.f5.com/csp/article/K23605346 Mitigation, Vendor Advisory ([email protected])
https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/ Exploit, Mitigation, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://support.f5.com/csp/article/K23605346 Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/ Exploit, Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)