F5 · BIG-IP and BIG-IQ Centralized Management
CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
Qué es
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CISA: F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 17 de noviembre de 2021
Más fallos explotados de F5
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 22 sept 2026 | Heap-based Buffer Overflow | BIG-IP APM | Crítica 9,3 | 25% |
| 27 mar 2026 | Stack-Based Buffer Overflow | BIG-IP | Crítica 9,3 | 2,3% |
| 31 oct 2023 | Authentication Bypass | BIG-IP Configuration Utility | Crítica 9,8 | 97% |
| 31 oct 2023 | SQL Injection | BIG-IP Configuration Utility | Alto 8,8 | 4,2% |
| 10 may 2022 | Missing Authentication | BIG-IP | Crítica 9,8 | >99,9% |
| 18 ene 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Crítica 9,8 | 62% |
| 3 nov 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Crítica 9,8 | >99,9% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.