F5 BIG-IP iControl REST Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2022-1388)
Executive & SecOps Summary
SECOPS ASSESSMENTF5 BIG-IP versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all end-of-support 12.1.x and 11.6.x versions
Unauthenticated remote attackers can bypass iControl REST authentication via crafted HTTP requests, enabling them to execute arbitrary system commands with root privileges on the target system
Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The most effective remediation is upgrading to a patched F5 BIG-IP release. Verify your current version and apply the update using the following commands.
# Check the current BIG-IP system version
tmsh show sys version
# Install the patched ISO image (e.g., 16.1.2.2 or later) onto a target volume
tmsh install sys software image BIGIP-16.1.2.2.0.0.28.iso volume HD1.2 create-volume
tmsh reboot volume HD1.22. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, restrict access to the management interface and modify self-IP configurations to block unauthorized iControl REST requests.
# 1. Restrict access to the Management Port (httpd) to trusted IP ranges only
tmsh modify sys httpd allow replace { 10.10.10.0/24 }
tmsh save sys config
# 2. Block HTTPS (Port 443) access on Self IPs via Port Lockdown
tmsh modify net self [Self-IP-Name] allow-service delete { tcp:443 }
tmsh save sys config3. Log Audit & IoC Verification Commands
Inspect system logs to detect potential exploitation attempts targeting the iControl REST interface.
# 1. Search httpd and restjavad logs for suspicious iControl REST and bash utility requests
grep -E '/mgmt/shared/authz/tokens|/mgmt/tm/util/bash' /var/log/httpd/httpd_errors /var/log/restjavad.0.log 2>/dev/null
# 2. Audit user creation and privilege modification events
grep -i 'user' /var/log/auditStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-1388) is a critical authentication bypass in the iControl REST component of F5 BIG-IP. The root cause lies in the improper handling of HTTP request headers during proxying. When an attacker includes 'X-F5-Auth-Token' within the 'Connection' header, a header smuggling or hop-by-hop header manipulation vulnerability is triggered between the frontend Apache web server and the backend Jetty application. This causes the backend to bypass authentication token validation, treating the unauthenticated request as a trusted administrative action.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP POST request to iControl REST endpoints, such as /mgmt/shared/authz/tokens or /mgmt/tm/util/bash. By setting the headers Connection: keep-alive, X-F5-Auth-Token and X-F5-Auth-Token: <any_value>, the frontend proxy treats 'X-F5-Auth-Token' as a hop-by-hop header and strips it before forwarding. However, due to parser discrepancies, the backend authentication module fails to enforce token validation. This allows the attacker to invoke the /mgmt/tm/util/bash utility endpoint without authentication, executing arbitrary shell commands with root privileges.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild. Successful exploitation grants full administrative control over the BIG-IP appliance. Attackers can leverage this position to perform lateral movement within the internal network, decrypt network traffic, harvest credentials, conduct Man-in-the-Middle (MitM) attacks, or cause widespread denial of service (DoS), leading to severe business disruption and data breaches.
Official Vendor Advisories & References
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Frequently Asked SecOps Questions (CVE-2022-1388)
FAQQ1. How critical is CVE-2022-1388 and is it actively exploited in the wild?
CVE-2022-1388 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-1388?
Primary impacted vendors include f5 across big-ip. Scope summary: F5 BIG-IP 16.1.0 to 16.1.2.1, 15.1.0 to 15.1.5, 14.1.0 to 14.1.4.5, 13.1.0 to 13.1.4.9, and all end-of-support 12.1.x and 11.6.x versions
Q3. What temporary mitigations or workarounds exist for CVE-2022-1388 before patching?
[Mitigation] Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-1388
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (f5)
View Category →F5 BIG-IP APM OAuth Authorization Server Remote Code Execution (RCE) Vulnerability (CVE-2026-94127)
[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.
TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
MikroTik RouterOS Authentication Bypass, Kernel Panic, and Info Leak (CVE-2026-67277) Security Advisory
[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.