CVE-2021-22980: Code Injection
In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-22980.
What is the severity of CVE-2021-22980?
The severity of CVE-2021-22980 is high, with a severity value of 7.8.
Which software versions are affected by CVE-2021-22980?
CVE-2021-22980 affects F5 Access Policy Manager Clients versions 7.1.5 to 7.1.8.5, 7.1.9 to 7.1.9.8, and 7.2.1 to 7.2.1.1.
What is the description of CVE-2021-22980?
CVE-2021-22980 is an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows that could allow an attacker to load a malicious DLL library from its current directory.
How can I fix CVE-2021-22980?
To fix CVE-2021-22980, upgrade to Edge Client version 7.2.1.1, 7.1.9.8, or 7.1.8.5.