# CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

- Page: https://www.vulneraibility.com/cve/CVE-2022-1388
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-05-10; CISA due date 2022-05-31; known ransomware use
- EPSS: 99.95% (percentile 100.0)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 65 GitHub proofs of concept · 1 Nuclei template (first 2022-05-05)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-01-29)
- Weakness: CWE-306
- Published: 2022-05-05

## Affected versions

- F5 BIG-IP: affected >= 16.1.x and < 16.1.2.2; >= 15.1.x and < 15.1.5.1; >= 14.1.x and < 14.1.4.6; >= 13.1.x and < 13.1.5; >= 12.1.x and <= 12.1.6; >= 11.6.x and <= 11.6.5; fixed in >= 17.0.0 and < 17.0.x*

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.f5.com/csp/article/K23605346
- [other] http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html
- [other] https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.