CVE-2022-25946

CVE-2022-25946 affects F5 BIG-IP Guided Configuration (GC) and related appliance-mode implementations. The vulnerability arises from a missing integrity check, allowing an authenticated Administrator to bypass Appliance mode restrictions. Affected: GC in 9.x and all GC-enabled appliances; BIG-IP ...

CVE-2022-1468

On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of...

CVE-2022-1468

CVE-2022-1468 affects BIG-IP iControl REST. An authenticated iControl REST user with at least guest privileges can cause processing delays in iControl REST requests, potentially leading to DoS on the iControl REST daemon. Impact is limited to control-plane; no data-plane exposure is indicated. Af...

CVE-2022-1389

CVE-2022-1389 concerns F5 BIG-IP TMUI CSRF vulnerability. Affected: BIG-IP TMUI on versions 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x; fixed in 17.0.0. Description from vendor: CSRF on an undisclosed TMUI page enables an attacker to run a limited set of commands (ping, traceroute, WOM di...

CVE-2022-1389

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP fixed in 17.0.0, a cross-site request forgery CSRF vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping,...

CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End o...

CVE-2022-1388

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End o...

CVE-2022-1388

CVE-2022-1388 affects F5 BIG-IP iControl REST authentication. Affected: BIG-IP 16.1.x before 16.1.2.2; 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5; and all 12.1.x and 11.6.x. Root cause per CNVD/CISA: authentication bypass via iControl REST, enabling unauthenticated acces...

CVE-2022-27659

CVE-2022-27659 affects F5 BIG-IP TMUI (Traffic Management User Interface). An authenticated attacker can modify or delete dashboards created by other BIG-IP users on vulnerable branches. Affects 16.1.x (<16.1.2.2), 15.1.x (<15.1.5.1), and 14.1.x (

CVE-2022-27659

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface TMUI. Note: Software versions which have reach...

CVE-2022-27636

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, BIG-IP Edge Client may log sensitive AP...

CVE-2022-27636

CVE-2022-27636 is a logging vulnerability in F5 BIG-IP APM Edge Client for Windows where sensitive APM session information can be written to logs when VPN is launched. The connected F5 advisory K57110035 confirms affected products and provides fixed versions: BIG-IP APM (16.1.2.2; 16.x), (15.1.5....

CVE-2022-27230

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, a reflected cross-site scripting XSS vulnerability exists in an undisclosed page of F5 BIG-IP Guided Configuration that allows an attacker to...

CVE-2022-27230

CVE-2022-27230 describes a reflected XSS vulnerability in F5 BIG-IP Guided Configuration (GC) pages and BIG-IP APM. Affected: BIG-IP APM (versions 11.6–16.1.x) and GC (prior to 9.0). Root cause: reflected JavaScript execution in an undisclosed GC page when accessed by an authenticated user; explo...

CVE-2022-27189

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol ICAP profile is configured on a virtual server, undisclosed...

CVE-2022-27189

CVE-2022-27189 affects BIG-IP ICAP profile on any BIG-IP module where an ICAP profile is configured on a virtual server, with undisclosed traffic potentially causing increased TMM memory resource utilization and DoS. Root cause: CWE-681 (type conversion). Affected branches and known-vulnerable ve...

CVE-2022-27182

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual server is configured with the type set to Reject, undisclosed requests can cause an increase in memory resource utilizatio...

CVE-2022-27182

CVE-2022-27182 affects F5 BIG-IP packet filtering when a virtual server uses the Reject type. The issue causes undisclosed requests to increase memory resource utilization, potentially degrading system performance (DoS). Affected versions are: BIG-IP 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1...

CVE-2022-27181

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when APM is configured on a virtual server and the associated access profile is configured with APM AAA...

CVE-2022-27181

CVE-2022-27181 affects F5 BIG-IP APM when an access profile uses APM AAA NTLM Auth. Exploitation leads to increased internal resource utilization and potential DoS on the BIG-IP device. Affected branches and known vulnerable ranges include: BIG-IP APM 16.1.x (16.1.0–16.1.2, fixed in 16.1.2.2), 15...