F5 BIG-IP and BIG-IQ iControl REST Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2021-22986) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

CVE-2021-22986 is a critical unauthenticated remote code execution (RCE) vulnerability in the iControl REST interface of F5 BIG-IP and BIG-IQ appliances. The root cause lies in the improper authentication validation and Server-Side Request Forgery (SSRF, CWE-918) flaws within the internal API communication channels. An attacker can bypass authentication controls by sending specially crafted HTTP requests to the iControl REST endpoints, allowing them to execute administrative commands without valid credentials.

2. Exploitation Mechanics & Attack Scenario

Attackers target the exposed iControl REST API port (typically HTTPS 443). The exploitation flow generally proceeds as follows:

• The attacker targets internal utility endpoints such as /mgmt/shared/authn/login or /mgmt/tm/util/bash.
• By manipulating headers like X-F5-Auth-Token or leveraging SSRF to route requests via localhost, the attacker bypasses the authentication filter.
• Once bypassed, the attacker sends a JSON payload containing arbitrary shell commands to the util/bash endpoint.
• The BIG-IP system executes the command with root privileges and returns the output to the attacker.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk to enterprise infrastructure. Because BIG-IP devices function as critical Application Delivery Controllers (ADCs) and load balancers, compromise allows attackers to perform lateral movement into internal networks, intercept sensitive SSL/TLS traffic, steal private keys, and establish persistent backdoors.