Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2022-41622 is a high-severity CSRF (CWE-352) vulnerability in F5 Big-Ip Advanced Firewall Manager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-41622 is a cross-site request forgery vulnerability present in all supported versions of F5 BIG-IP and BIG-IQ when iControl SOAP is used. The flaw is tracked under CWE-352 and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low complexity, no required privileges, and required user interaction that can result in high impact to confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the issue by tricking an authenticated administrative user into submitting a malicious request, allowing the attacker to perform arbitrary actions within the victim’s session on the affected BIG-IP or BIG-IQ system.
The vendor advisory K94221585 describes mitigation steps and available updates. The associated EPSS score rose from a low baseline to a peak of 0.8126 on 2025-12-11 before receding to its current value of 0.5977, indicating that exploitation interest increased after public disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44813
Vulnerability Data
In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces that every iControl SOAP request must satisfy authorization checks beyond mere session presence, directly blocking forged requests that lack a valid anti-CSRF token or origin.
Requires cryptographic or protocol-level verification that SOAP requests are part of an authentic, non-forged session, preventing CSRF from succeeding against BIG-IP/BIG-IQ administrative sessions.
Mandates validation of all SOAP input parameters and headers, enabling detection and rejection of requests that do not contain required anti-CSRF tokens or expected referer/origin values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.