CVE-2022-1388 : BIG-IP iControl REST vulnerability

by CIRT Team

16 May 2022

in CVE, Security Advisories & Alerts

No Comments

1101

CVE-2022-1388: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication.

Impact:

This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services.

CVSS v3.1 Base Score: 9.8 CRITICAL

Mitigation: Updates are available. Please see the references or vendor advisory for more information.
https://support.f5.com/csp/article/K23605346

Reference URL’s:
https://nvd.nist.gov/vuln/detail/CVE-2022-1388
https://support.f5.com/csp/article/K23605346