CVEvulnerability

CVE-2022-1388

9.8 CRITICAL Known exploited Published 2022-05-05 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

F5 BIG-IP Missing Authentication Vulnerability — F5 BIG-IP

F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

Added to KEV: 2022-05-10
Remediation due: 2022-05-31
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-1388

Status: Analyzed
Published: 2022-05-05
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-306

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected configurations

• f5 big-ip access policy manager (>= 11.6.1 <= 11.6.5) • f5 big-ip access policy manager (>= 12.1.0 <= 12.1.6) • f5 big-ip access policy manager (>= 13.1.0 < 13.1.5) • f5 big-ip access policy manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip access policy manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip access policy manager (>= 16.1.0 < 16.1.2.2) • f5 big-ip advanced firewall manager (>= 11.6.1 <= 11.6.5) • f5 big-ip advanced firewall manager (>= 12.1.0 <= 12.1.6) • f5 big-ip advanced firewall manager (>= 13.1.0 < 13.1.5) • f5 big-ip advanced firewall manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip advanced firewall manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip advanced firewall manager (>= 16.1.0 < 16.1.2.2) • f5 big-ip analytics (>= 11.6.1 <= 11.6.5) • f5 big-ip analytics (>= 12.1.0 <= 12.1.6) • f5 big-ip analytics (>= 13.1.0 < 13.1.5) • f5 big-ip analytics (>= 14.1.0 < 14.1.4.6) • f5 big-ip analytics (>= 15.1.0 < 15.1.5.1) • f5 big-ip analytics (>= 16.1.0 < 16.1.2.2) • f5 big-ip application acceleration manager (>= 11.6.1 <= 11.6.5) • f5 big-ip application acceleration manager (>= 12.1.0 <= 12.1.6) • f5 big-ip application acceleration manager (>= 13.1.0 < 13.1.5) • f5 big-ip application acceleration manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip application acceleration manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip application acceleration manager (>= 16.1.0 < 16.1.2.2) • f5 big-ip application security manager (>= 11.6.1 <= 11.6.5) • f5 big-ip application security manager (>= 12.1.0 <= 12.1.6) • f5 big-ip application security manager (>= 13.1.0 < 13.1.5) • f5 big-ip application security manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip application security manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip application security manager (>= 16.1.0 < 16.1.2.2) • f5 big-ip domain name system (>= 11.6.1 <= 11.6.5) • f5 big-ip domain name system (>= 12.1.0 <= 12.1.6) • f5 big-ip domain name system (>= 13.1.0 < 13.1.5) • f5 big-ip domain name system (>= 14.1.0 < 14.1.4.6) • f5 big-ip domain name system (>= 15.1.0 < 15.1.5.1) • f5 big-ip domain name system (>= 16.1.0 < 16.1.2.2) • f5 big-ip fraud protection service (>= 11.6.1 <= 11.6.5) • f5 big-ip fraud protection service (>= 12.1.0 <= 12.1.6) • f5 big-ip fraud protection service (>= 13.1.0 < 13.1.5) • f5 big-ip fraud protection service (>= 14.1.0 < 14.1.4.6) • f5 big-ip fraud protection service (>= 15.1.0 < 15.1.5.1) • f5 big-ip fraud protection service (>= 16.1.0 < 16.1.2.2) • f5 big-ip global traffic manager (>= 11.6.1 <= 11.6.5) • f5 big-ip global traffic manager (>= 12.1.0 <= 12.1.6) • f5 big-ip global traffic manager (>= 13.1.0 < 13.1.5) • f5 big-ip global traffic manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip global traffic manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip global traffic manager (>= 16.1.0 < 16.1.2.2) • f5 big-ip link controller (>= 11.6.1 <= 11.6.5) • f5 big-ip link controller (>= 12.1.0 <= 12.1.6) • f5 big-ip link controller (>= 13.1.0 < 13.1.5) • f5 big-ip link controller (>= 14.1.0 < 14.1.4.6) • f5 big-ip link controller (>= 15.1.0 < 15.1.5.1) • f5 big-ip link controller (>= 16.1.0 < 16.1.2.2) • f5 big-ip local traffic manager (>= 11.6.1 <= 11.6.5) • f5 big-ip local traffic manager (>= 12.1.0 <= 12.1.6) • f5 big-ip local traffic manager (>= 13.1.0 < 13.1.5) • f5 big-ip local traffic manager (>= 14.1.0 < 14.1.4.6) • f5 big-ip local traffic manager (>= 15.1.0 < 15.1.5.1) • f5 big-ip local traffic manager (>= 16.1.0 < 16.1.2.2) … and 6 more

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References