CVE-2022-41617

moderate-risk

Published 2022-10-19

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.

Do I need to act?

4.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.2/10 High

NETWORK / LOW complexity

Affected Products (2)

Big-Ip Advanced Web Application Firewall

Big-Ip Application Security Manager

Affected Vendors

References (2)

Vendor Advisory https://support.f5.com/csp/article/K11830089

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 8/34 · Low

Exposure 7/34 · Low