F5 · BIG-IP
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
What it is
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CISA: F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 31, 2022
- Added to the CISA list
- May 10, 2022
- Published
- May 5, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-306
- More details
- NVD · CVE.org · CISA
All references (5)
- https://support.f5.com/csp/article/K23605346
- http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html
- https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
More exploited flaws from F5
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 27, 2026 | Stack-Based Buffer Overflow | BIG-IP | Critical 9.3 | 2.3% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critical 9.8 | >99.9% |
| Sep 22, 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critical 9.3 | 25% |
| Oct 31, 2023 | Authentication Bypass | BIG-IP Configuration Utility | Critical 9.8 | 97% |
| Oct 31, 2023 | SQL Injection | BIG-IP Configuration Utility | High 8.8 | 4.2% |
| Jan 18, 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Critical 9.8 | 62% |
| Nov 3, 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Critical 9.8 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.