CVE-2022-1388 : BIG-IP iControl REST vulnerability
by CIRT Team
CVE-2022-1388: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication.
Impact:
This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services.
CVSS v3.1 Base Score: 9.8 CRITICAL
Mitigation: Updates are available. Please see the references or vendor advisory for more information.
https://support.f5.com/csp/article/K23605346
Reference URL’s:
https://nvd.nist.gov/vuln/detail/CVE-2022-1388
https://support.f5.com/csp/article/K23605346
Recommended Posts
Emerging Threat_Stealer Malware (Lumma C2) Campaign with fake CAPTCHA pages
08 Oct 2024 - Security Advisories & Alerts