CVE-2022-41800: Appliance mode iControl REST vulnerability
In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41800?
CVE-2022-41800 is a vulnerability in all versions of BIG-IP when running in Appliance mode that allows an authenticated user to bypass restrictions and cross security boundaries using an undisclosed iControl REST endpoint.
How severe is CVE-2022-41800?
CVE-2022-41800 has a severity rating of 8.7 (high).
Which versions of BIG-IP are affected by CVE-2022-41800?
Versions 13.1.0 to 13.1.5, 14.1.0 to 14.1.5, 15.1.0 to 15.1.8, 16.1.0 to 16.1.3, and 17.0.0 of F5 BIG-IP products are affected by CVE-2022-41800.
Is there a patch or fix available for CVE-2022-41800?
F5 may release patches or updates to address CVE-2022-41800, check their official support page for more information.
What is the Common Weakness Enumeration ID associated with CVE-2022-41800?
CVE-2022-41800 is associated with CWE-77.