PT-2021-3907 · F5 · Big-Iq+1

Published 2021-03-10 · Updated 2026-04-30 · CVE-2021-22986

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 16.0.x through 16.0.1.1 F5 BIG-IP versions 15.1.x through 15.1.2.1 F5 BIG-IP versions 14.1.x through 14.1.4 F5 BIG-IP versions 13.1.x through 13.1.3.6 F5 BIG-IP versions 12.1.x through 12.1.5.3 F5 BIG-IQ versions 7.1.0.x through 7.1.0.3 F5 BIG-IQ versions 7.0.0.x through 7.0.0.2

Description The iControl REST interface has an unauthenticated remote command execution issue. This allows attackers with network access to the iControl REST interface through the BIG-IP management interface to execute arbitrary system commands, create or delete files, and disable services. The vulnerability can lead to complete system compromise. The BIG-IP system in Appliance mode is also affected.

Recommendations F5 BIG-IP versions 16.0.x through 16.0.1.1: Update to version 16.0.1.1 or later. F5 BIG-IP versions 15.1.x through 15.1.2.1: Update to version 15.1.2.1 or later. F5 BIG-IP versions 14.1.x through 14.1.4: Update to version 14.1.4 or later. F5 BIG-IP versions 13.1.x through 13.1.3.6: Update to version 13.1.3.6 or later. F5 BIG-IP versions 12.1.x through 12.1.5.3: Update to version 12.1.5.3 or later. F5 BIG-IQ versions 7.1.0.x through 7.1.0.3: Update to version 7.1.0.3 or later. F5 BIG-IQ versions 7.0.0.x through 7.0.0.2: Update to version 7.0.0.2 or later.

Exploit

Fix

RCE

OS Command Injection

SSRF

Weakness Enumeration

CWE-78

CWE-918

Related Identifiers

BDU:2021-04388

CVE-2021-22986

Affected Products

Big-Ip

Big-Iq

References · 63

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb · Exploit
• 🔥 https://github.com/Al1ex/CVE-2021-22986 · Exploit
• 🔥 https://github.com/dorkerdevil/CVE-2021-22986-Poc · Exploit
• 🔥 https://github.com/S1xHcL/f5_rce_poc · Exploit
• 🔥 https://github.com/Tas9er/CVE-2021-22986 · Exploit
• 🔥 https://github.com/west9b/F5-BIG-IP-POC · Exploit
• 🔥 https://github.com/yaunsky/CVE-202122986-EXP · Exploit
• 🔥 https://github.com/safesword/F5_RCE · Exploit
• 🔥 https://github.com/ZephrFish/CVE-2021-22986_Check · Exploit
• 🔥 http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/49738 · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2021-22986-SSRF2RCE · Exploit, Deleted
• https://bdu.fstec.ru/vul/2021-04388 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22986 · Security Note