Vulnerability · Published Dec 7, 2022 · Assigned by f5
CVE-2022-41622iControl SOAP vulnerability
High 8.8
In plain English
A high-severity cross-site request forgery in BIG-IP from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 92.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)92.4%top 0.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Metasploit, Public PoC
Official description
In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | BIG-IP | 17.x16.1.x15.1.x14.1.x13.1.x |
| F5 | BIG-IQ Centralized Management | 8.x7.1.x |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H