Critical 9.8Known exploited (CISA KEV)Published May 5, 2022
CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed…
Updated under an hour ago ()
Does this affect you?
It affects F5 BIG-IP and 11 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 10, 2022; federal agencies had to remediate by May 31, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
from 17.0.0 before 17.0.x* not affected; from 16.1.x before 16.1.2.2; from 15.1.x before 15.1.5.1; from 14.1.x before 14.1.4.6; from 13.1.x before 13.1.5; from 12.1.x through 12.1.6; from 11.6.x through 11.6.5
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
from 11.6.1 through 11.6.5; from 12.1.0 through 12.1.6; from 13.1.0 before 13.1.5; from 14.1.0 before 14.1.4.6; from 15.1.0 before 15.1.5.1; from 16.1.0 before 16.1.2.2
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
