CVE-2022-1388: critical vulnerability in F5 BIG-IP
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDMay 5
1st PoCMay 5
metasploitMay 4
CISA KEV+5d
Action required by CISAfederal deadline: 2022-05-31
Apply updates per vendor instructions.
In short
F5 BIG-IP devices with certain software versions allow attackers to bypass authentication on the iControl REST API, granting unauthorized access to critical system management functions without valid credentials.
Technical detail
CWE-306 (Missing Authentication Check): Unauthenticated requests to iControl REST on vulnerable BIG-IP versions bypass authentication mechanisms, allowing remote attackers to directly access administrative functions. Affected versions include 16.1.x (<16.1.2.2), 15.1.x (<15.1.5.1), 14.1.x (<14.1.4.6), 13.1.x (<13.1.5), and all 12.1.x and 11.6.x versions. Impact includes full device compromise and configuration manipulation.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
F5 · BIG-IPpublic PoCs found — 134
exploitdbwww.exploit-db.com/exploits/50932unverifiedgithubgithub.com/horizon3ai/CVE-2022-1388★ 229githubgithub.com/doocop/CVE-2022-1388-EXP★ 92githubgithub.com/alt3kx/CVE-2022-1388_PoC★ 87githubgithub.com/0xf4n9x/CVE-2022-1388★ 84githubgithub.com/ZephrFish/F5-CVE-2022-1388-Exploit★ 59githubgithub.com/sherlocksecurity/CVE-2022-1388-Exploit-POC★ 56githubgithub.com/numanturle/CVE-2022-1388★ 53githubgithub.com/Al1ex/CVE-2022-1388★ 37githubgithub.com/MrCl0wnLab/Nuclei-Template-CVE-2022-1388-BIG-IP-iControl-REST-Exposed★ 28githubgithub.com/jheeree/CVE-2022-1388-checker★ 25githubgithub.com/PsychoSec2/CVE-2022-1388-POC★ 14githubgithub.com/justakazh/CVE-2022-1388★ 13githubgithub.com/Zeyad-Azima/CVE-2022-1388★ 12githubgithub.com/west9b/F5-BIG-IP-POC★ 10githubgithub.com/blind-intruder/CVE-2022-1388-RCE-checker-and-POC-Exploit★ 8githubgithub.com/Henry4E36/CVE-2022-1388★ 8githubgithub.com/vaelwolf/CVE-2022-1388★ 7githubgithub.com/qusaialhaddad/F5-BigIP-CVE-2022-1388★ 7githubgithub.com/Vulnmachines/F5-Big-IP-CVE-2022-1388★ 7githubgithub.com/MrCl0wnLab/Nuclei-Template-Exploit-F5-BIG-IP-iControl-REST-Auth-Bypass-RCE-Command-Parameter★ 6githubgithub.com/0x7eTeam/CVE-2022-1388-PocExp★ 6githubgithub.com/bandit92/CVE2022-1388_TestAPI★ 5githubgithub.com/AmirHoseinTangsiriNET/CVE-2022-1388-Scanner★ 5githubgithub.com/Angus-Team/F5-BIG-IP-RCE-CVE-2022-1388★ 5githubgithub.com/Stonzyy/Exploit-F5-CVE-2022-1388★ 5githubgithub.com/gotr00t0day/CVE-2022-1388★ 5githubgithub.com/nvk0x/CVE-2022-1388-exploit★ 3githubgithub.com/revanmalang/CVE-2022-1388★ 2githubgithub.com/SecTheBit/CVE-2022-1388★ 2githubgithub.com/savior-only/CVE-2022-1388★ 2githubgithub.com/devengpk/CVE-2022-1388★ 2githubgithub.com/saucer-man/CVE-2022-1388★ 2githubgithub.com/superzerosec/CVE-2022-1388★ 2githubgithub.com/aancw/CVE-2022-1388-rs★ 2githubgithub.com/EvilLizard666/CVE-2022-1388★ 2githubgithub.com/nico989/CVE-2022-1388★ 1githubgithub.com/TheElderHacker/CVE-2022-1388★ 1githubgithub.com/chesterblue/CVE-2022-1388★ 1githubgithub.com/ThinkingOffensively/CVE-2022-1388★ 1githubgithub.com/thatonesecguy/CVE-2022-1388-Exploit★ 1githubgithub.com/amitlttwo/CVE-2022-1388★ 1githubgithub.com/Chocapikk/CVE-2022-1388★ 1githubgithub.com/LinJacck/CVE-2022-1388-EXP★ 1githubgithub.com/iveresk/cve-2022-1388-1veresk★ 1githubgithub.com/shamo0/CVE-2022-1388★ 1githubgithub.com/vesperp/CVE-2022-1388-F5-BIG-IP★ 1githubgithub.com/0xAgun/CVE-2022-1388★ 1githubgithub.com/iveresk/cve-2022-1388-iveresk-command-shell★ 1githubgithub.com/Luchoane/CVE-2022-1388_refresh★ 1githubgithub.com/j-baines/tippa-my-tongue★ 1githubgithub.com/yukar1z0e/CVE-2022-1388★ 1githubgithub.com/mr-vill4in/CVE-2022-1388★ 0githubgithub.com/sashka3076/F5-BIG-IP-exploit★ 0githubgithub.com/li8u99/CVE-2022-1388★ 0githubgithub.com/Hudi233/CVE-2022-1388★ 0githubgithub.com/pauloink/CVE-2022-1388★ 0githubgithub.com/Osyanina/westone-CVE-2022-1388-scanner★ 0githubgithub.com/omnigodz/CVE-2022-1388★ 0githubgithub.com/battleofthebots/refresh★ 0githubgithub.com/M4fiaB0y/CVE-2022-1388★ 0githubgithub.com/impost0r/CVE-2022-1388★ 0githubgithub.com/jermainlaforce/CVE-2022-1388-POC★ 0githubgithub.com/Wrin9/CVE-2022-1388★ 0githubgithub.com/On-Cyber-War/CVE-2022-1388★ 0githubgithub.com/SudeepaShiranthaka/F5-BIG-IP-Remote-Code-Execution-Vulnerability-CVE-2022-1388-A-Case-Study★ 0githubgithub.com/jbharucha05/CVE-2022-1388★ 0githubgithub.com/r0otk3r/CVE-2022-1388★ 0vulncheckvulncheck.com/xdb/f633dcc58943unverifiedcve_referencepacketstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/3fe86ad28ffeunverifiedvulncheckvulncheck.com/xdb/792f8d436653unverifiedvulncheckvulncheck.com/xdb/f0d43db5ffcbunverifiedvulncheckvulncheck.com/xdb/a0cd074f32a8unverifiedvulncheckvulncheck.com/xdb/8bb60772cff1unverifiedvulncheckvulncheck.com/xdb/5a2182b56ffdunverifiedvulncheckvulncheck.com/xdb/502567296299unverifiedvulncheckvulncheck.com/xdb/d2f6260efc0funverifiedvulncheckvulncheck.com/xdb/9574cfe06a5cunverifiedvulncheckvulncheck.com/xdb/a90a4f4fa523unverifiedvulncheckvulncheck.com/xdb/da0ee1760a50unverifiedvulncheckvulncheck.com/xdb/3ac3f4ccae08unverifiedvulncheckvulncheck.com/xdb/284187c7cc92unverifiedvulncheckvulncheck.com/xdb/6f0d150b9526unverifiedvulncheckvulncheck.com/xdb/1beebdc63339unverifiedvulncheckvulncheck.com/xdb/c5bc057dd650unverifiedvulncheckvulncheck.com/xdb/317ac291487cunverifiedvulncheckvulncheck.com/xdb/1374857fc440unverifiedvulncheckvulncheck.com/xdb/2a3d27be8a50unverifiedvulncheckvulncheck.com/xdb/089a0ce1c93aunverifiedvulncheckvulncheck.com/xdb/bf15a5b1ddeaunverifiedvulncheckvulncheck.com/xdb/b187533ab332unverifiedvulncheckvulncheck.com/xdb/4f60c165a253unverifiedvulncheckvulncheck.com/xdb/39da6fb6bae8unverifiedvulncheckvulncheck.com/xdb/fed4ce564309unverifiedvulncheckvulncheck.com/xdb/4e0a09831520unverifiedvulncheckvulncheck.com/xdb/91f823cf5ee3unverifiedvulncheckvulncheck.com/xdb/19a91efb19cbunverifiedvulncheckvulncheck.com/xdb/c18be49db148unverifiedvulncheckvulncheck.com/xdb/a2fba35605c7unverifiedvulncheckvulncheck.com/xdb/e8d37213acfbunverifiedvulncheckvulncheck.com/xdb/d47c793055aaunverifiedvulncheckvulncheck.com/xdb/55c8c0c71985unverifiedvulncheckvulncheck.com/xdb/86b7a33d25f4unverifiedvulncheckvulncheck.com/xdb/1ce7755efb91unverifiedvulncheckvulncheck.com/xdb/7819f0e28fc2unverifiedvulncheckvulncheck.com/xdb/0869637d461dunverifiedvulncheckvulncheck.com/xdb/e391ecaf162bunverifiedvulncheckvulncheck.com/xdb/bd11226cd569unverifiedvulncheckvulncheck.com/xdb/92cfa936edecunverifiedvulncheckvulncheck.com/xdb/de351a9eaa73unverifiedvulncheckvulncheck.com/xdb/7c3dfa418e9dunverifiedvulncheckvulncheck.com/xdb/1e755f4e5a91unverifiedvulncheckvulncheck.com/xdb/4ecf220a775eunverifiedvulncheckvulncheck.com/xdb/dfd966532bd4unverifiedvulncheckvulncheck.com/xdb/c5dcb13ada50unverifiedvulncheckvulncheck.com/xdb/f8e5e3946332unverifiedvulncheckvulncheck.com/xdb/4b67e5ac9d66unverifiedvulncheckvulncheck.com/xdb/a338399b9740unverifiedvulncheckvulncheck.com/xdb/596c32191ea1unverifiedvulncheckvulncheck.com/xdb/eaac7855e8baunverifiedvulncheckvulncheck.com/xdb/f174aa99be3aunverifiedvulncheckvulncheck.com/xdb/db69e56a1a55unverifiedvulncheckvulncheck.com/xdb/d8d92a442a79unverifiedvulncheckvulncheck.com/xdb/02a73fcd6f5funverifiedvulncheckvulncheck.com/xdb/fe095bfcae0aunverifiedvulncheckvulncheck.com/xdb/49c26aab032eunverifiedvulncheckvulncheck.com/xdb/b3ba3d9e25bbunverifiedvulncheckvulncheck.com/xdb/e99d73741e42unverifiedvulncheckvulncheck.com/xdb/6ee894157174unverifiedvulncheckvulncheck.com/xdb/205de2915c78unverifiedcve_referencepacketstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/5ab1c09d90e2unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — F5 BIG-IP
In the same product, most dangerous first.
CVE-2023-46747CRITICALBIG-IP Configuration utility unauthenticated remote code execution vulnerabilityEPSS 96.7%KEVCVE-2026-94127CRITICALBIG-IP APM OAuth vulnerabilityEPSS 26.6%KEVCVE-2023-46748HIGHBIG-IP Configuration utility authenticated SQL injection vulnerabilityEPSS 4.3%KEVCVE-2025-53521CRITICALBigIP APM VulnerabilityEPSS 2.3%KEVCVE-2022-41622HIGHiControl SOAP vulnerabilityEPSS 92.4%CVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%
References
http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlhttps://support.f5.com/csp/article/K23605346https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/