CVE-2022-13889.8CriticalCWE-306
F5 BIG-IP Missing Authentication Vulnerability
F5 · BIG-IP
Exploited in the wild · in CISA KEV since 10 May 2022Vendor fix availableKnown ransomware use
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 10 May · catalogue entry
Passed 1612 days ago
DescriptionNVD
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CISA required action
Apply updates per vendor instructions.
Coverage1 article · 1 outlet
First in our coverage: SecurityWeek, 15 Sep.
- Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BBSecurityWeek · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.