CVE-2022-1388

Deeper analysis

CVE-2022-1388 is an authentication bypass vulnerability affecting the iControl REST interface on F5 BIG-IP appliances. It impacts versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all releases in the 12.1.x and 11.6.x branches; versions that have reached end of technical support are excluded from evaluation. The flaw is tracked as CWE-306 and carries a CVSS 3.1 base score of 9.8.

Unauthenticated attackers with network access can send specially crafted requests that evade iControl REST authentication checks. Successful exploitation grants the ability to execute arbitrary commands, read or modify configuration data, and fully compromise the affected device, consistent with the critical severity rating and multiple public remote-code-execution proof-of-concept releases.

F5’s advisory K23605346 directs customers to upgrade to the fixed releases listed above and, where patching is not immediately feasible, to restrict management access or disable iControl REST. Additional guidance from vendors and researchers emphasizes applying the updates promptly and monitoring for indicators of the bypass technique.

The vulnerability’s EPSS score has remained at a persistently high level, with a recorded peak of 0.9752 and a current value of 0.9446, indicating sustained exploitation interest since disclosure. Public exploit code targeting multiple BIG-IP branches has been circulating since shortly after publication.