The vulnerability of the iControl REST API interface for access control and remote authentication solutions like BIG-IP (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO) as well as the server software BIG-IQ Centralized Management allows a perpetrator to execute arbitrary commands on the target system.

🗓️ 06 Sep 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

The iControl REST API and Big IQ Centralized Management risk arbitrary command execution due to insufficient argument validation.

Reporter	Title	Published	Views	Family All 56
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	7 May 202217:54	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	10 May 202204:10	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	23 Mar 202102:04	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	19 Mar 202118:50	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	7 Feb 202311:19	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	21 Mar 202107:40	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	22 Mar 202107:13	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager	26 Mar 202103:32	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	7 May 202217:54	–	githubexploit
GithubExploit	Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager	28 May 202213:30	–	githubexploit

Vulners

Node

f5_networks,big-ip_application_acceleration_managerRange15.1.0–15.1.2.1

f5_networks,big-ip_application_acceleration_managerRange14.1.0–14.1.4

f5_networks,big-ip_application_acceleration_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_application_acceleration_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_advanced_web_application_firewallRange16.0.0–16.0.1.1

f5_networks,big-ip_advanced_web_application_firewallRange15.1.0–15.1.2.1

f5_networks,big-ip_advanced_web_application_firewallRange14.1.0–14.1.4

f5_networks,big-ip_advanced_web_application_firewallRange13.1.0–13.1.3.6

f5_networks,big-ip_advanced_firewall_managerRange16.0.0–16.0.1.1

f5_networks,big-ip_advanced_firewall_managerRange15.1.0–15.1.2.1

f5_networks,big-ip_advanced_firewall_managerRange14.1.0–14.1.4

f5_networks,big-ip_advanced_firewall_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_advanced_firewall_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_analyticsRange16.0.0–16.0.1.1

f5_networks,big-ip_analyticsRange15.1.0–15.1.2.1

f5_networks,big-ip_analyticsRange14.1.0–14.1.4

f5_networks,big-ip_analyticsRange13.1.0–13.1.3.6

f5_networks,big-ip_analyticsRange12.1.0–12.1.5.3

f5_networks,big-ip_access_policy_managerRange16.0.0–16.0.1.1

f5_networks,big-ip_access_policy_managerRange15.1.0–15.1.2.1

f5_networks,big-ip_access_policy_managerRange14.1.0–14.1.4

f5_networks,big-ip_access_policy_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_access_policy_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_application_security_managerRange16.0.0–16.0.1.1

f5_networks,big-ip_application_security_managerRange14.1.0–14.1.4

f5_networks,big-ip_application_security_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_application_security_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_ddos_hybrid_defenderRange16.0.0–16.0.1.1

f5_networks,big-ip_ddos_hybrid_defenderRange15.1.0–15.1.2.1

f5_networks,big-ip_ddos_hybrid_defenderRange14.1.0–14.1.4

f5_networks,big-ip_ddos_hybrid_defenderRange13.1.0–13.1.3.6

f5_networks,big-ip_dnsRange16.0.0–16.0.1.1

f5_networks,big-ip_dnsRange15.1.0–15.1.2.1

f5_networks,big-ip_dnsRange14.1.0–14.1.4

f5_networks,big-ip_dnsRange13.1.0–13.1.3.6

f5_networks,big-ip_dnsRange12.1.0–12.1.5.3

f5_networks,big-ip_global_traffic_managerRange16.0.0–16.0.1.1

f5_networks,big-ip_global_traffic_managerRange15.1.0–15.1.2.1

f5_networks,big-ip_global_traffic_managerRange14.1.0–14.1.4

f5_networks,big-ip_global_traffic_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_global_traffic_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_link_controllerRange16.0.0–16.0.1.1

f5_networks,big-ip_link_controllerRange15.1.0–15.1.2.1

f5_networks,big-ip_link_controllerRange14.1.0–14.1.4

f5_networks,big-ip_link_controllerRange13.1.0–13.1.3.6

f5_networks,big-ip_link_controllerRange12.1.0–12.1.5.3

f5_networks,big-ip_policy_enforcement_managerRange16.0.0–16.0.1.1

f5_networks,big-ip_policy_enforcement_managerRange15.1.0–15.1.2.1

f5_networks,big-ip_policy_enforcement_managerRange14.1.0–14.1.4

f5_networks,big-ip_policy_enforcement_managerRange13.1.0–13.1.3.6

f5_networks,big-ip_policy_enforcement_managerRange12.1.0–12.1.5.3

f5_networks,big-ip_ssl_orchestratorRange16.0.0–16.0.1.1

f5_networks,big-ip_ssl_orchestratorRange15.1.0–15.1.2.1

f5_networks,big-ip_ssl_orchestratorRange14.1.0–14.1.4

f5_networks,big-ip_ssl_orchestratorRange13.1.0–13.1.3.6

f5_networks,big-ip_ssl_orchestratorRange12.1.0–12.1.5.3

f5_networks,big-iq_centralized_managementRange7.1.0–7.1.0.3

f5_networks,big-iq_centralized_managementRange7.0.0–7.0.0.2

f5_networks,big-ip_ltmRange16.0.0–16.0.1.1

f5_networks,big-ip_ltmRange15.1.0–15.1.2.1

f5_networks,big-ip_ltmRange14.1.0–14.1.4

f5_networks,big-ip_ltmRange13.1.0–13.1.3.6

f5_networks,big-ip_ltmRange12.1.0–12.1.5.3

f5_networks,big-ip_application_acceleration_managerRange16.0.0–16.0.1

Source	Link
support	www.support.f5.com/csp/article/K03009991
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2021031102
packetstormsecurity	www.packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

8.5High risk

Vulners AI Score8.5

CVSS 39.8

CVSS 210

EPSS0.99898