cyfenced.com →

[ CVE-2022-1388 · Published 5 May 2022 ]

F5 BIG-IP Missing Authentication Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 100%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-10
  • Known to be used in ransomware campaigns
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CISA: F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 31 May 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References