Vulnerability · Published Aug 4, 2022 · Assigned by f5

CVE-2022-33962BIG-IP iRule vulnerability CVE-2022-33962

Medium 6.7

In plain English

A medium-severity privilege mismanagement in BIG-IP from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.2%top 90.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products (as reported)

Vendor	Product	Versions
F5	BIG-IP	13.1.0 – before 13.1.x*14.1.x – before 14.1.5.115.1.x – before 15.1.6.116.1.x – before 16.1.3.117.0.x – before 17.0.0.1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://support.f5.com/csp/article/K80970653 x_refsource_MISC