CVE-2022-1388

CRITICAL severity · CVSS 9.8 · Missing authentication · actively exploited (CISA KEV)

9.8CVSS CRITICAL ● exploited ⚠ ransomware

🔴 Actively exploited in the wild (CISA Known Exploited Vulnerabilities). ⚠ Known use in ransomware campaigns. Added to KEV 2022-05-10. US federal agencies must patch by 2022-05-31.

Summary

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)94%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

F5 BIG-IP

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

CVE-2022-1388

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information