CVE-2022-41622highCWE-352

CVE-2022-41622: high-severity vulnerability in F5 BIG-IP

iControl SOAP vulnerability

Published · Updated

Follow this CVE+ Monitor BIG-IP+ Monitor BIG-IQ Centralized Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.8epss 92%
from disclosure to weaponsame day
Published on NVDDec 7
metasploitNov 16
In short

BIG-IP and BIG-IQ systems can be attacked through iControl SOAP, where a malicious website tricks an authenticated user into performing unwanted actions without their knowledge. This allows attackers to manipulate critical network and security configurations.

Technical detail

CSRF vulnerability in iControl SOAP interface affecting BIG-IP and BIG-IQ, exploitable via malicious web pages against authenticated administrators. Attack requires victim to visit attacker-controlled site while maintaining active session; successful exploitation enables unauthorized modification of system configurations and security policies.

Summary generated and translated by AI from the official description.
In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
F5 · BIG-IPF5 · BIG-IQ Centralized Management
Related CVEs — F5 BIG-IP

In the same product, most dangerous first.

CVE-2022-1388CRITICALCVE-2022-1388EPSS 100.0%KEVCVE-2023-46747CRITICALBIG-IP Configuration utility unauthenticated remote code execution vulnerabilityEPSS 96.7%KEVCVE-2026-94127CRITICALBIG-IP APM OAuth vulnerabilityEPSS 26.6%KEVCVE-2023-46748HIGHBIG-IP Configuration utility authenticated SQL injection vulnerabilityEPSS 4.3%KEVCVE-2025-53521CRITICALBigIP APM VulnerabilityEPSS 2.3%KEVCVE-2022-41800HIGHAppliance mode iControl REST vulnerabilityEPSS 76.9%