9.8
Critique
Exploitée
· rançongiciel
CVE-2022-1388 F5 BIG-IP Missing Authentication Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-306
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BIG-IP 17.0 | premières → < 17.0.0 | 17.0.0 |
| BIG-IP 16.1 | 16.1.x → < 16.1.2.2 | 16.1.2.2 |
| BIG-IP 15.1 | 15.1.x → < 15.1.5.1 | 15.1.5.1 |
| BIG-IP 14.1 | 14.1.x → < 14.1.4.6 | 14.1.4.6 |
| BIG-IP 13.1 | 13.1.x → < 13.1.5 | 13.1.5 |
| BIG-IP 12.1 | 12.1.x → 12.1.6 | Pas de correctif indiqué |
| BIG-IP 11.6 | 11.6.x → 11.6.5 | Pas de correctif indiqué |
Références
- support.f5.com support.f5.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
- www.secpod.com www.secpod.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de BIG-IP
Les 259 CVE de BIG-IP →
CVE-2026-94127
F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
9.8
Critique
CVE-2026-66842
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts…
8.8
Élevée
CVE-2026-63020
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error…
3.1
Faible
CVE-2026-59762
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory…
7.5
Élevée