PT-2022-5573 · F5 · Big-Ip
Published
2022-11-16
·
Updated
2022-12-12
·
CVE-2022-41800
CVSS v3.1
8.7
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
BIG-IP versions prior to the fixed version
Description
The issue is related to an undisclosed iControl REST endpoint in BIG-IP, allowing an authenticated user with the Administrator role to bypass Appliance mode restrictions when running in Appliance mode. A successful exploit can allow the attacker to cross a security boundary. The vulnerability is also associated with insufficient argument checking in the iControl REST interface, which can be exploited by a remote attacker to bypass existing security restrictions.
Recommendations
For BIG-IP, consider disabling access to the undisclosed iControl REST endpoint until a patch is available.
As a temporary workaround, restrict the use of the Administrator role to minimize the risk of exploitation.
Avoid using the vulnerable iControl REST interface in Appliance mode until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Big-Ip