CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-05-05
F5 BIG-IP iControl REST Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2022-1388)
[Affected Scope] F5 BIG-IP versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all end-of-support 12.1.x and 11.6.x versions
[Impact] Unauthenticated remote attackers can bypass iControl REST authentication via crafted HTTP requests, enabling them to execute arbitrary system commands with root privileges on the target system
[Mitigation] Immediately upgrade to the patched versions, restrict access to the management interface, or apply temporary workarounds such as modifying self-IP port lockdown settings