CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
F5 BIG-IP iControl REST Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2022-1388)
[Affected Scope] F5 BIG-IP versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all end-of-support 12.1.x and 11.6.x versions
[Impact] Unauthenticated remote attackers can bypass iControl REST authentication via crafted HTTP requests, enabling them to execute arbitrary system commands with root privileges on the target system
[Mitigation] Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings
F5 BIG-IP and BIG-IQ iControl REST Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2021-22986) Analysis and Mitigation Guide
[Affected Scope] F5 BIG-IP (16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x) and BIG-IQ (7.1.0.x, 7.0.0.x) management interfaces running iControl REST.
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges, leading to complete compromise of the target device.
[Mitigation] Immediately upgrade to the patched versions provided by F5 and restrict access to the iControl REST interface (TCP 443) from untrusted networks.