CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2022-1388

CVSS 9.8v3.1pub. 2022-05-05upd. 2025-10-27

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • F5 Big Ip Access Policy Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Advanced Firewall Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Analytics

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Application Acceleration Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Application Security Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Domain Name System

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Fraud Protection Service

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Global Traffic Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Link Controller

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Local Traffic Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

  • F5 Big Ip Policy Enforcement Manager

    APP
    F5
    11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (bez)14.1.0 – 14.1.4.6 (bez)15.1.0 – 15.1.5.1 (bez)16.1.0 – 16.1.2.2 (bez)

CISA KEV — detailsi

Vendori
F5 ↗
Producti
BIG-IP
Added to KEVi
May 10, 2022
Remediation deadline (US Federal)i
May 31, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 31 maja 2022
CWE
References

Related vulnerabilities

CVE-2025-53521CRITICAL9.3⚠ KEVPL ✓ten sam produkt

RCE w F5 BIG-IP APM poprzez złośliwy ruch sieciowy (stack buffer overflow)

CVE-2023-46747CRITICAL9.8⚠ KEVten sam produkt

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access...

CVE-2021-22991CRITICAL9.8⚠ KEVten sam produkt

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3....

CVE-2021-22986CRITICAL9.8⚠ KEVten sam produkt

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3....

CVE-2020-5902CRITICAL9.8⚠ KEVten sam produkt

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, th...