CVE-2022-1388

critical-risk
Published 2022-05-05

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Do I need to act?

!
94.5% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
50932
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (11)

Affected Vendors

F5

References (11)

Exploit http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html
Exploit http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Executi...
Exploit http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execu...
Mitigation https://support.f5.com/csp/article/K23605346
Exploit https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerabili...
Exploit http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html
Exploit http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Executi...
Exploit http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execu...
Mitigation https://support.f5.com/csp/article/K23605346
Exploit https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerabili...
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...
75
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 27/34 · High
Exposure 16/34 · Moderate