CVE-2022-41622
Published: 07 December 2022
Summary
CVE-2022-41622 is a high-severity CSRF (CWE-352) vulnerability in F5 Big-Ip Advanced Firewall Manager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-41622 is a cross-site request forgery vulnerability present in all supported versions of F5 BIG-IP and BIG-IQ when iControl SOAP is used. The flaw is tracked under CWE-352 and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low complexity, no required privileges, and required user interaction that can result in high impact to confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the issue by tricking an authenticated administrative user into submitting a malicious request, allowing the attacker to perform arbitrary actions within the victim’s session on the affected BIG-IP or BIG-IQ system.
The vendor advisory K94221585 describes mitigation steps and available updates. The associated EPSS score rose from a low baseline to a peak of 0.8126 on 2025-12-11 before receding to its current value of 0.5977, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44813
Vulnerability details
In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.