The vulnerability of the iControl REST interface for access control and remote authentication in BIG-IP allows a perpetrator to circumvent existing security restrictions.

🗓️ 23 Nov 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

iControl REST in BIG-IP enables remote bypass of access control and authentication through improper argument handling.

Reporter	Title	Published	Views	Family All 30
0day.today	F5 BIG-IP iControl Cross Site Request Forgery Exploit	21 Nov 202200:00	–	zdt
0day.today	F5 Big-IP Create Administrative User Exploit	3 Feb 202300:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager	12 Apr 202320:46	–	githubexploit
ATTACKERKB	CVE-2022-41800	7 Dec 202200:00	–	attackerkb
Circl	CVE-2022-41800	17 Nov 202212:36	–	circl
CNNVD	F5 BIG-IP 命令注入漏洞	16 Nov 202200:00	–	cnnvd
Check Point Advisories	F5 Big-IP Command Injection (CVE-2022-41800)	23 Nov 202200:00	–	checkpoint_advisories
CVE	CVE-2022-41800	7 Dec 202203:12	–	cve
Cvelist	CVE-2022-41800 Appliance mode iControl REST vulnerability	7 Dec 202203:12	–	cvelist
F5 Networks	K13325942: Appliance mode iControl REST vulnerability CVE-2022-41800	6 Jan 202309:11	–	f5

Vulners

Node

f5_networks,big-iq_centralized_managementRange8.0.0–8.2.0

OR

f5_networks,big-iq_centralized_managementRange7.0.0–7.1.0

OR

f5_networks,big-ip_access_policy_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_advanced_firewall_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_analyticsRange13.1.0–13.1.5

OR

f5_networks,big-ip_application_acceleration_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_fraud_protection_serviceRange13.1.0–13.1.5

OR

f5_networks,big-ip_global_traffic_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_link_controllerRange13.1.0–13.1.5

OR

f5_networks,big-ip_local_traffic_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_policy_enforcement_managerRange13.1.0–13.1.5

OR

f5_networks,big-ip_access_policy_managerMatch17.0.0

OR

f5_networks,big-ip_access_policy_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_access_policy_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_access_policy_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_advanced_firewall_managerMatch17.0.0

OR

f5_networks,big-ip_advanced_firewall_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_advanced_firewall_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_advanced_firewall_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_analyticsRange14.1.0–14.1.5

OR

f5_networks,big-ip_analyticsRange15.1.0–15.1.8

OR

f5_networks,big-ip_analyticsRange16.1.0–16.1.3

OR

f5_networks,big-ip_analyticsMatch17.0.0

OR

f5_networks,big-ip_application_acceleration_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_application_acceleration_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_application_acceleration_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_application_acceleration_managerMatch17.0.0

OR

f5_networks,big-ip_dnsMatch17.0.0

OR

f5_networks,big-ip_dnsRange16.1.0–16.1.3

OR

f5_networks,big-ip_dnsRange15.1.0–15.1.8

OR

f5_networks,big-ip_dnsRange14.1.0–14.1.5

OR

f5_networks,big-ip_dnsRange13.1.0–13.1.5

OR

f5_networks,big-ip_fraud_protection_serviceRange14.1.0–14.1.5

OR

f5_networks,big-ip_fraud_protection_serviceRange15.1.0–15.1.8

OR

f5_networks,big-ip_fraud_protection_serviceRange16.1.0–16.1.3

OR

f5_networks,big-ip_fraud_protection_serviceMatch17.0.0

OR

f5_networks,big-ip_global_traffic_managerMatch17.0.0

OR

f5_networks,big-ip_global_traffic_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_global_traffic_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_global_traffic_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_link_controllerRange14.1.0–14.1.5

OR

f5_networks,big-ip_link_controllerRange15.1.0–15.1.8

OR

f5_networks,big-ip_link_controllerRange16.1.0–16.1.3

OR

f5_networks,big-ip_link_controllerMatch17.0.0

OR

f5_networks,big-ip_local_traffic_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_local_traffic_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_local_traffic_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_local_traffic_managerMatch17.0.0

OR

f5_networks,big-ip_policy_enforcement_managerRange14.1.0–14.1.5

OR

f5_networks,big-ip_policy_enforcement_managerRange15.1.0–15.1.8

OR

f5_networks,big-ip_policy_enforcement_managerRange16.1.0–16.1.3

OR

f5_networks,big-ip_policy_enforcement_managerMatch17.0.0

Source	Link
support	www.support.f5.com/csp/article/K13325942
web	www.web.nvd.nist.gov/view/vuln/detail

23 Nov 2022 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 28.5

CVSS 38.7

EPSS0.62406

control interface vulnerability remote bypass access control authentication bypass argument handling