CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2022-1388

CVSS 9.8v3.1pub. 2022-05-05upd. 2025-10-27

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

F5 Big Ip Access Policy Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Advanced Firewall Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Analytics
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Application Acceleration Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Application Security Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Domain Name System
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Fraud Protection Service
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Global Traffic Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Link Controller
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Local Traffic Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)
F5 Big Ip Policy Enforcement Manager
APP
F5
11.6.1 – 11.6.512.1.0 – 12.1.613.1.0 – 13.1.5 (excl.)14.1.0 – 14.1.4.6 (excl.)15.1.0 – 15.1.5.1 (excl.)16.1.0 – 16.1.2.2 (excl.)

CISA KEV — detailsi

Vendori: F5 ↗
Producti: BIG-IP
Added to KEVi: May 10, 2022
Remediation deadline (US Federal)i: May 31, 2022(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory F5↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

🔴