K29282483 : BIG-IP APM CTU vulnerability CVE-2021-22980

Security Advisory Description

An untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows can allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability because the victim must run this utility on the Windows system. (CVE-2021-22980)

Impact

For some diagnostic functions, you must run the CTU as a privileged user. The CTU prompts the user to escalate privileges for those functions. This vulnerability can allow attackers to trick a victim into loading an arbitrary DLL as a privileged user on the vulnerable Windows system.

For more information about the CTU, refer to K12444: Overview of the Client Troubleshooting Utility for Windows.