PT-2022-2443 · F5 · Big-Ip

Published

2022-05-05

·

Updated

2025-10-27

·

CVE-2022-1388

CVSS v3.1
10
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.x, 12.1.x, 13.1.x prior to 13.1.5, 14.1.x prior to 14.1.4.6, 15.1.x prior to 15.1.5.1, and 16.1.x prior to 16.1.2.2
Description The vulnerability allows unauthenticated attackers with network access to bypass the iControl REST authentication mechanism on F5 BIG-IP systems. Successful exploitation can lead to arbitrary system command execution, file manipulation, or service disruption. Reports indicate active exploitation of this issue, with attackers attempting to compromise systems shortly after the vulnerability became public. The vulnerability resides in the iControl REST API and affects systems running in standard or device mode, with a critical severity when device mode is enabled. The vulnerability allows attackers to execute arbitrary system commands, create or delete files, or disable services.
Recommendations Update F5 BIG-IP to version 16.1.2.2 or later. Update F5 BIG-IP to version 15.1.5.1 or later. Update F5 BIG-IP to version 14.1.4.6 or later. Update F5 BIG-IP to version 13.1.5 or later. Update F5 BIG-IP to a version not affected by this issue.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-02849
CVE-2022-1388

Affected Products

Big-Ip