peter bassill · operator
$ cve CVE-2021-22986 JSON

CVE-2021-22986 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2021-11-17.

Description

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS99.9% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-918
On CISA KEVyes — remediate by 2021-11-17
Public exploityes
Published2021-03-31
Last modified2026-06-17

CISA KEV

NameF5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
Added2021-11-03
Due2021-11-17
Vendor / productF5 / BIG-IP and BIG-IQ Centralized Management
Ransomware useknown

Affected (15)

VendorProduct
f5big-ip access policy manager
f5big-ip advanced firewall manager
f5big-ip advanced web application firewall
f5big-ip analytics
f5big-ip application acceleration manager
f5big-ip application security manager
f5big-ip ddos hybrid defender
f5big-ip domain name system
f5big-ip fraud protection service
f5big-ip global traffic manager
f5big-ip link controller
f5big-ip local traffic manager
f5big-ip policy enforcement manager
f5big-iq centralized management
f5ssl orchestrator

Public exploits

SourceTitleDate
exploit-dbF5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)2021-04-02

References

→ the Explorer  ·  watch your stack  ·  NVD