All vulnerabilities
CVE-2022-1388

F5 BIG-IP Missing Authentication Vulnerability

F5 BIG-IPNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 10 May 2022. Known ransomware useCISA KEV
Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.1.2.2Also 15.1.5.1, 14.1.4.6 and 1 moreCVE List
Federal deadline31 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 4 May 2022Exploit code publicMetasploit
  2. 5 May 2022, 16:18 UTCPublishedCVE List
  3. 10 May 2022Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Exploit moduleF5 BIG-IP iControl RCE via REST Authentication Bypass 4 May 2022Metasploit
  • Remote exploitF5 BIG-IP 16.0.x - Remote Code Execution (RCE) 12 May 2022Exploit-DB
  • Scanner templateF5 BIG-IP iControl - REST Auth Bypass RCENuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

Text from CVE List

Affected versions 7

  • BIG-IPunaffected: 17.0.0 before 17.0.x*CVE List
  • BIG-IPaffected: 16.1.x before 16.1.2.2CVE List
  • BIG-IPaffected: 15.1.x before 15.1.5.1CVE List
  • BIG-IPaffected: 14.1.x before 14.1.4.6CVE List
  • BIG-IPaffected: 13.1.x before 13.1.5CVE List
  • BIG-IPaffected: 12.1.x through 12.1.6CVE List
  • BIG-IPaffected: 11.6.x through 11.6.5CVE List

References 4