CVE-2022-27806: Command Injection

Q: What is the severity of CVE-2022-27806?

The severity of CVE-2022-27806 is rated as high with a CVSS score of 7.2.

Q: Which versions of F5 BIG-IP Advanced WAF ASM are affected by CVE-2022-27806?

Versions 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF ASM are affected by CVE-2022-27806.

Q: How can an authenticated attacker exploit CVE-2022-27806?

An authenticated attacker assigned the Administrator role may be able to bypass Appliance mode in F5 BIG-IP Advanced WAF ASM.

Published May 5, 2022

Updated

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing command injection vulnerabilities in undisclosed URIs in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected Software

55 affected components

F5 BIG-IP Access Policy Manager=13.1.0

F5 BIG-IP Access Policy Manager=13.1.1

F5 BIG-IP Access Policy Manager=13.1.3

F5 BIG-IP Access Policy Manager=13.1.4

F5 BIG-IP Access Policy Manager=13.1.5

F5 BIG-IP Access Policy Manager=14.1.0

F5 BIG-IP Access Policy Manager=14.1.2

F5 BIG-IP Access Policy Manager=14.1.3

F5 BIG-IP Access Policy Manager=14.1.4

F5 BIG-IP Access Policy Manager=15.1.0

F5 BIG-IP Access Policy Manager=15.1.1

F5 BIG-IP Access Policy Manager=15.1.2

F5 BIG-IP Access Policy Manager=15.1.3

F5 BIG-IP Access Policy Manager=15.1.4

F5 BIG-IP Access Policy Manager=15.1.5

F5 BIG-IP Access Policy Manager=16.1.0

F5 BIG-IP Access Policy Manager=16.1.1

F5 BIG-IP Access Policy Manager=16.1.2

F5 Big-ip Advanced Web Application Firewall=13.1.0

F5 Big-ip Advanced Web Application Firewall=13.1.1

F5 Big-ip Advanced Web Application Firewall=13.1.3

F5 Big-ip Advanced Web Application Firewall=13.1.4

F5 Big-ip Advanced Web Application Firewall=13.1.5

F5 Big-ip Advanced Web Application Firewall=14.1.0

F5 Big-ip Advanced Web Application Firewall=14.1.2

F5 Big-ip Advanced Web Application Firewall=14.1.3

F5 Big-ip Advanced Web Application Firewall=14.1.4

F5 Big-ip Advanced Web Application Firewall=15.1.0

F5 Big-ip Advanced Web Application Firewall=15.1.1

F5 Big-ip Advanced Web Application Firewall=15.1.2

F5 Big-ip Advanced Web Application Firewall=15.1.3

F5 Big-ip Advanced Web Application Firewall=15.1.4

F5 Big-ip Advanced Web Application Firewall=15.1.5

F5 Big-ip Advanced Web Application Firewall=16.1.0

F5 Big-ip Advanced Web Application Firewall=16.1.1

F5 Big-ip Advanced Web Application Firewall=16.1.2

F5 BIG-IP Application Security Manager=13.1.0

F5 BIG-IP Application Security Manager=13.1.1

F5 BIG-IP Application Security Manager=13.1.3

F5 BIG-IP Application Security Manager=13.1.4

F5 BIG-IP Application Security Manager=13.1.5

F5 BIG-IP Application Security Manager=14.1.0

F5 BIG-IP Application Security Manager=14.1.2

F5 BIG-IP Application Security Manager=14.1.3

F5 BIG-IP Application Security Manager=14.1.4

F5 BIG-IP Application Security Manager=15.1.0

F5 BIG-IP Application Security Manager=15.1.1

F5 BIG-IP Application Security Manager=15.1.2

F5 BIG-IP Application Security Manager=15.1.3

F5 BIG-IP Application Security Manager=15.1.4

F5 BIG-IP Application Security Manager=15.1.5

F5 BIG-IP Application Security Manager=16.1.0

F5 BIG-IP Application Security Manager=16.1.1

F5 BIG-IP Application Security Manager=16.1.2

F5 BIG-IP Guided Configuration<9.0

Event History

May 5, 2022

CVE Published

via MITRE·04:29 PM

Data Sourced

via MITRE·04:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-27806?

The severity of CVE-2022-27806 is rated as high with a CVSS score of 7.2.

Which versions of F5 BIG-IP Advanced WAF ASM are affected by CVE-2022-27806?

Versions 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF ASM are affected by CVE-2022-27806.

How can an authenticated attacker exploit CVE-2022-27806?

An authenticated attacker assigned the Administrator role may be able to bypass Appliance mode in F5 BIG-IP Advanced WAF ASM.

CVE-2022-27806: Command Injection

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2022-27806?

Which versions of F5 BIG-IP Advanced WAF ASM are affected by CVE-2022-27806?

How can an authenticated attacker exploit CVE-2022-27806?

Company

Resources

Contact