Published: 07/12/2022 Updated: 07/11/2023

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 0

In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 big-iq centralized management 7.1.0
f5 big-iq centralized management
f5 big-ip advanced firewall manager 17.0.0
f5 big-ip advanced firewall manager
f5 big-ip analytics 17.0.0
f5 big-ip analytics
f5 big-ip access policy manager 17.0.0
f5 big-ip access policy manager
f5 big-ip application security manager 17.0.0
f5 big-ip application security manager
f5 big-ip domain name system 17.0.0
f5 big-ip domain name system
f5 big-ip fraud protection service 17.0.0
f5 big-ip fraud protection service
f5 big-ip global traffic manager 17.0.0
f5 big-ip global traffic manager
f5 big-ip link controller 17.0.0
f5 big-ip link controller
f5 big-ip local traffic manager 17.0.0
f5 big-ip local traffic manager
f5 big-ip policy enforcement manager 17.0.0
f5 big-ip policy enforcement manager
f5 big-ip application acceleration manager 17.0.0
f5 big-ip application acceleration manager

This Metasploit module creates a local user with a username/password and root-level privileges Note that a root-level account is not required to do this, which makes it a privilege escalation issue Note that this is pretty noisy, since it creates a user account and creates log files and such Additionally, most (if not all) vulnerabilities in F5 ...

This Metasploit module exploits a cross-site request forgery (CSRF) vulnerability in F5 Big-IP's iControl interface to write an arbitrary file to the filesystem While any file can be written to any location as root, the exploitability is limited by SELinux; the vast majority of writable locations are unavailable By default, we write to a script t ...

This Metasploit module exploits a newline injection into an RPM rpmspec file that permits authenticated users to remotely execute commands Successful exploitation results in remote code execution as the root user ...

CWE-352 https://support.f5.com/csp/article/K94221585 https://nvd.nist.gov https://packetstormsecurity.com/files/170847/F5-Big-IP-Create-Administrative-User.html

CVE-2022-41622

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect