CVE-2021-22986criticalunder attackransomwareCWE-918

CVE-2021-22986: critical vulnerability in BIG-IP; BIG-IQ

Published · Updated

Follow this CVE+ Monitor BIG-IP+ Monitor BIG-IQ Centralized Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDMar 31
1st PoCSep 13
metasploitMar 10
CISA KEV+217d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

The iControl REST interface in F5 BIG-IP and BIG-IQ allows attackers to execute commands remotely without authentication. This means an attacker can take complete control of the affected device over the network without needing a password.

Technical detail

An unauthenticated remote attacker can execute arbitrary commands on BIG-IP and BIG-IQ devices via the iControl REST API (CWE-918: Server-Side Request Forgery). No authentication or user interaction is required; exploitation occurs by sending crafted requests to the vulnerable REST endpoint, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · BIG-IP; BIG-IQ
public PoCs found — 30
exploitdbwww.exploit-db.com/exploits/49738unverifiedgithubgithub.com/Al1ex/CVE-2021-22986★ 90githubgithub.com/dorkerdevil/CVE-2021-22986-Poc★ 51githubgithub.com/S1xHcL/f5_rce_poc★ 26githubgithub.com/Tas9er/CVE-2021-22986★ 13githubgithub.com/west9b/F5-BIG-IP-POC★ 10githubgithub.com/yaunsky/CVE-202122986-EXP★ 8githubgithub.com/safesword/F5_RCE★ 4githubgithub.com/ZephrFish/CVE-2021-22986_Check★ 3githubgithub.com/huydung26/CVE-2021-22986★ 0githubgithub.com/amitlttwo/CVE-2021-22986★ 0githubgithub.com/kiri-48/CVE-2021-22986★ 0githubgithub.com/microvorld/CVE-2021-22986★ 0githubgithub.com/Osyanina/westone-CVE-2021-22986-scanner★ 0githubgithub.com/dotslashed/CVE-2021-22986★ 0githubgithub.com/DDestinys/CVE-2021-22986★ 0vulncheckvulncheck.com/xdb/7ef17b2a67c8unverifiedvulncheckvulncheck.com/xdb/d01e8176dce5unverifiedcve_referencepacketstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/022bf13f255cunverifiedvulncheckvulncheck.com/xdb/67d59972eddeunverifiedvulncheckvulncheck.com/xdb/d719e86bdadbunverifiedvulncheckvulncheck.com/xdb/37d1bc32376aunverifiedvulncheckvulncheck.com/xdb/c08513ca427bunverifiedcve_referencepacketstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/faf1551a76aaunverifiedvulncheckvulncheck.com/xdb/9ee47c54b7bdunverifiedvulncheckvulncheck.com/xdb/c553095b1410unverifiedvulncheckvulncheck.com/xdb/f21108c1266dunverifiedvulncheckvulncheck.com/xdb/320fae5d1635unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.