CVEs / CVE-2022-1388
CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability
- Known exploited in the CISA KEV catalog since 10 May 2022
- high 7.5 CVSS 2.0 (NVD)
- EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2022-1388
Summary
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| F5 BIG-IP | from 16.1.x, before 16.1.2.2 | 16.1.2.2 |
| F5 BIG-IP | from 15.1.x, before 15.1.5.1 | 15.1.5.1 |
| F5 BIG-IP | from 14.1.x, before 14.1.4.6 | 14.1.4.6 |
| F5 BIG-IP | from 13.1.x, before 13.1.5 | 13.1.5 |
| F5 BIG-IP | from 12.1.x, up to and including 12.1.6 | — |
| F5 BIG-IP | from 11.6.x, up to and including 11.6.5 | — |
Exploitation
| In CISA KEV since | 10 May 2022 |
|---|---|
| Due date for US federal agencies | 31 May 2022 |
| Used in ransomware campaigns | Known |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 2.0 | 7.5 highAV:N/AC:L/Au:N/C:P/I:P/A:PScored by NVD |
|---|---|
| Weakness | CWE-306 |
References
- CVE-2022-1388 on NVD
- CVE-2022-1388 in the CISA KEV catalog
- http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://support.f5.com/csp/article/K23605346 Mitigation, Vendor Advisory
- https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/ Exploit, Mitigation, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.