$ cve CVE-2022-1388 JSON

CVE-2022-1388 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-31.

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.95% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-306
On CISA KEV	yes — remediate by 2022-05-31
Public exploit	yes
Published	2022-05-05
Last modified	2026-06-17

CISA KEV

Name	F5 BIG-IP Missing Authentication Vulnerability
Added	2022-05-10
Due	2022-05-31
Vendor / product	F5 / BIG-IP
Ransomware use	known

Affected (11)

Vendor	Product
f5	big-ip access policy manager
f5	big-ip advanced firewall manager
f5	big-ip analytics
f5	big-ip application acceleration manager
f5	big-ip application security manager
f5	big-ip domain name system
f5	big-ip fraud protection service
f5	big-ip global traffic manager
f5	big-ip link controller
f5	big-ip local traffic manager
f5	big-ip policy enforcement manager

Public exploits

Source	Title	Date
exploit-db	F5 BIG-IP 16.0.x - Remote Code Execution (RCE)	2022-05-12

References

→ the Explorer · watch your stack · NVD