The vulnerability of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status analysis tool, the BIG-IP Application Acceleration Manager, the DDoS protection module, the BIG-IP Fraud Protection Service, the Internet traffic balancing system, the BIG-IP Link Controller, and the local traffic balancing system – all of these allow a perpetrator to cause service interruptions.

🗓️ 21 Jul 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerabilities in iControl REST API and BIG-IP components enable service interruptions via resource exhaustion.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-23023	25 Jan 202220:15	–	attackerkb
CNNVD	F5 BIG-IP 资源管理错误漏洞	19 Jan 202200:00	–	cnnvd
CNVD	F5 BIG-IP Resource Management Error Vulnerability (CNVD-2022-70626)	21 Jan 202200:00	–	cnvd
CVE	CVE-2022-23023	25 Jan 202219:11	–	cve
Cvelist	CVE-2022-23023	25 Jan 202219:11	–	cvelist
EUVD	EUVD-2022-28134	3 Oct 202520:07	–	euvd
F5 Networks	K11742742: iControl REST vulnerability CVE-2022-23023	21 Feb 202318:35	–	f5
F5 Networks	K40084114: Overview of F5 vulnerabilities (January 2022)	21 Feb 202318:54	–	f5
Tenable Nessus	F5 Networks BIG-IP : iControl REST vulnerability (K11742742)	19 Jan 202200:00	–	nessus
NCSC	Vulnerabilities fixed in F5 products	21 Jan 202200:00	–	ncsc

Vulners

Node

f5_networks,big-ip_access_policy_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_advanced_firewall_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_analyticsRange13.1.0–13.1.5

OR

f5_networks,big-ip_application_acceleration_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_application_security_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_link_controllerRange13.1.0–13.1.5

OR

f5_networks,big-ip_local_traffic_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_policy_enforcement_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_fraud_protection_serviceRange13.1.0–13.1.5

OR

f5_networks,big-ip_advanced_web_application_firewallRange13.1.0–13.1.5

OR

f5_networks,big-ip_advanced_web_application_firewallRange14.1.0–14.1.4.5

OR

f5_networks,big-iq_centralized_managementRange8.0.0–8.2.0

OR

f5_networks,big-iq_centralized_managementRange7.0.0–7.1.0

OR

f5_networks,big-ip_access_policy_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_access_policy_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_access_policy_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_advanced_firewall_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_advanced_firewall_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_advanced_firewall_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_advanced_web_application_firewallRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_advanced_web_application_firewallRange15.1.0–15.1.5

OR

f5_networks,big-ip_advanced_web_application_firewallRange12.1.0–12.1.5

OR

f5_networks,big-ip_advanced_firewall_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_access_policy_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_analyticsRange12.1.0–12.1.5

OR

f5_networks,big-ip_analyticsRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_analyticsRange15.1.0–15.1.5

OR

f5_networks,big-ip_analyticsRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_application_acceleration_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_application_acceleration_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_application_acceleration_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_application_acceleration_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_application_security_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_application_security_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_application_security_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_application_security_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_ddos_hybrid_defenderRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_ddos_hybrid_defenderRange15.1.0–15.1.5

OR

f5_networks,big-ip_ddos_hybrid_defenderRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_ddos_hybrid_defenderRange13.1.0–13.1.5

OR

f5_networks,big-ip_ddos_hybrid_defenderRange12.1.0–12.1.5

OR

f5_networks,big-ip_dnsRange12.1.0–12.1.5

OR

f5_networks,big-ip_dnsRange13.1.0–13.1.5

OR

f5_networks,big-ip_dnsRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_dnsRange15.1.0–15.1.5

OR

f5_networks,big-ip_dnsRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_fraud_protection_serviceRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_fraud_protection_serviceRange15.1.0–15.1.5

OR

f5_networks,big-ip_fraud_protection_serviceRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_fraud_protection_serviceRange12.1.0–12.1.5

OR

f5_networks,big-ip_global_traffic_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_global_traffic_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_global_traffic_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_global_traffic_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_global_traffic_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_link_controllerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_link_controllerRange15.1.0–15.1.5

OR

f5_networks,big-ip_link_controllerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_link_controllerRange12.1.0–12.1.5

OR

f5_networks,big-ip_local_traffic_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_local_traffic_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_local_traffic_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_local_traffic_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_policy_enforcement_managerRange16.1.0–16.1.2.1

OR

f5_networks,big-ip_policy_enforcement_managerRange15.1.0–15.1.5

OR

f5_networks,big-ip_policy_enforcement_managerRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_policy_enforcement_managerRange12.1.0–12.1.5

OR

f5_networks,big-ip_ssl_orchestratorRange12.1.0–12.1.5

OR

f5_networks,big-ip_ssl_orchestratorRange13.1.0–13.1.5

OR

f5_networks,big-ip_ssl_orchestratorRange14.1.0–14.1.4.5

OR

f5_networks,big-ip_ssl_orchestratorRange15.1.0–15.1.5

OR

f5_networks,big-ip_ssl_orchestratorRange16.1.0–16.1.2.1

Source	Link
support	www.support.f5.com/csp/article/K11742742
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23023
web	www.web.nvd.nist.gov/view/vuln/detail

21 Jul 2022 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 36.5

CVSS 26.8

EPSS0.00321

iControl interface access policy manager application protection server web application firewall firewall manager infrastructure status tool application acceleration manager distributed denial service fraud protection service internet traffic balancing link controller local traffic balancing