PT-2024-19202 · Icontrol · Icontrol

Published 2024-02-14 · Updated 2025-09-05 · CVE-2024-22093

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

The issue is related to an authenticated remote command injection in an undisclosed iControl REST endpoint on multi-bladed systems when running in appliance mode. A successful exploit can allow the attacker to cross a security boundary. The affected software is iControl, but the specific versions are not disclosed, except that software versions which have reached End of Technical Support (EoTS) are not evaluated. More information about the exploit can be found at https://t.co/QkeOfBPhqh or https://t.co/tIPZDtnkkz. #iControl #remoteCommandInjection #cybersecurityawareness #infosec #multiBladedSystems #applianceMode #cybersecurity

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-04586

CVE-2024-22093

Affected Products

Icontrol

References · 10

• https://osv.dev/vulnerability/CVE-2024-22093 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04586 · Security Note
• https://my.f5.com/manage/s/article/K000137522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22093 · Security Note
• https://t.me/cveNotify/134419 · Telegram Post
• https://t.me/cvenotify/108415 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757854753822818388 · Twitter Post
• https://twitter.com/CVEnew/status/1757806680073498653 · Twitter Post
• https://hkcert.org/security-bulletin/f5-products-multiple-vulnerabilities_20240216 · Note
• https://twitter.com/cracbot/status/1758008312640266477 · Twitter Post