CVE-2022-26372

On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is configured on a virtual server with DNS queueing default, undisclosed requests can cause an increase in memory resource...

CVE-2022-26372

CVE-2022-26372 affects F5 BIG-IP DNS profile: when a DNS listener on a virtual server uses DNS queueing (default), undisclosed requests can cause memory resource utilization to spike, leading to degraded performance or DoS. Affected branches and fixes per VULNERABILITY docs: BIG-IP 15.1.x before ...

CVE-2022-26370

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol SIP message routing framework MRF application layer gateway ALG profile is configured on a Message Routing virtual server, undisclosed request...

CVE-2022-26370

The CVE-2022-26370 issue affects F5 BIG-IP SIP MRF ALG profile on a Message Routing virtual server. Undisclosed requests can trigger termination of the Traffic Management Microkernel (TMM), causing traffic disruption/DoS as the TMM restarts. Affected versions: BIG-IP 16.1.x before 16.1.2.2, 15.1....

CVE-2022-26340

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacke...

CVE-2022-26340

CVE-2022-26340 affects F5 BIG-IP and BIG-IQ SCP functionality. An authenticated, high-privileged attacker with remote access and no bash access can read Certificate and Key files via SCP. Root cause is incorrect permission assignment for the SCP-accessible resources. Fixed versions include: BIG-I...

CVE-2022-26130

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing...

CVE-2022-26130

CVE-2022-26130 concerns F5 BIG-IP: when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections, effectively a denial-of-service on the BIG-IP data plane. Affected BIG-IP branches...

CVE-2022-26071

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel TMM allows an attack...

CVE-2022-26071

CVE-2022-26071 affects F5 BIG-IP TMM. Affected: BIG-IP 16.1.x before 16.1.2.2; 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5; all 12.1.x and 11.6.x. Description: flaw in how reply ICMP packets are limited in TMM enables off‑path attacker to scan UDP ports and bypass UDP sou...

CVE-2022-25946

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Applian...

CVE-2022-25946

CVE-2022-25946 affects F5 BIG-IP Guided Configuration (GC) and related appliance-mode implementations. The vulnerability arises from a missing integrity check, allowing an authenticated Administrator to bypass Appliance mode restrictions. Affected: GC in 9.x and all GC-enabled appliances; BIG-IP ...

CVE-2022-1468

On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of...

CVE-2022-1468

CVE-2022-1468 affects BIG-IP iControl REST. An authenticated iControl REST user with at least guest privileges can cause processing delays in iControl REST requests, potentially leading to DoS on the iControl REST daemon. Impact is limited to control-plane; no data-plane exposure is indicated. Af...

CVE-2022-1389

CVE-2022-1389 concerns F5 BIG-IP TMUI CSRF vulnerability. Affected: BIG-IP TMUI on versions 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x; fixed in 17.0.0. Description from vendor: CSRF on an undisclosed TMUI page enables an attacker to run a limited set of commands (ping, traceroute, WOM di...

CVE-2022-1389

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP fixed in 17.0.0, a cross-site request forgery CSRF vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping,...

CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End o...

CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End o...

CVE-2022-1388

CVE-2022-1388 affects F5 BIG-IP iControl REST authentication. Affected: BIG-IP 16.1.x before 16.1.2.2; 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5; and all 12.1.x and 11.6.x. Root cause per CNVD/CISA: authentication bypass via iControl REST, enabling unauthenticated acces...

CVE-2022-27659

CVE-2022-27659 affects F5 BIG-IP TMUI (Traffic Management User Interface). An authenticated attacker can modify or delete dashboards created by other BIG-IP users on vulnerable branches. Affects 16.1.x (<16.1.2.2), 15.1.x (<15.1.5.1), and 14.1.x (