VULNERABILITY INTELLIGENCE
CVE-2022-1388
CVSS score9.8 CRITICAL
EPSS probability99.95%
CISA KEVKnown exploited vulnerability
Published2022-05-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
F5 BIG-IP Missing Authentication Vulnerability
Vendor / product: F5 / BIG-IP
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Weakness classification
- f5sirt@f5.com: CWE-306
- nvd@nist.gov: CWE-306
Primary references
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Mitigation, Vendor Advisory
- f5sirt@f5.com — Exploit, Mitigation, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource