On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0,

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager13.0.0 and later · up to 13.1.3 inclusive
• f5 big-ip access policy manager14.0.0 and later · up to 14.1.2 inclusive
• f5 big-ip access policy manager15.0.0 and later · up to 15.1.0 inclusive
• f5 big-ip access policy manager11.5.1 and later · up to 11.6.5 inclusive
• f5 big-ip access policy manager12.1.0 and later · up to 12.1.5 inclusive
• f5 big-ip advanced firewall manager12.1.0 and later · up to 12.1.5 inclusive
• f5 big-ip advanced firewall manager14.0.0 and later · up to 14.1.2 inclusive
• f5 big-ip advanced firewall manager15.0.0 and later · up to 15.1.0 inclusive
• f5 big-ip advanced firewall manager11.5.1 and later · up to 11.6.5 inclusive
• f5 big-ip advanced firewall manager13.0.0 and later · up to 13.1.3 inclusive
• f5 big-ip analytics12.1.0 and later · up to 12.1.5 inclusive
• f5 big-ip analytics14.0.0 and later · up to 14.1.2 inclusive
• f5 big-ip analytics15.0.0 and later · up to 15.1.0 inclusive
• f5 big-ip analytics11.5.1 and later · up to 11.6.5 inclusive
• f5 big-ip analytics13.0.0 and later · up to 13.1.3 inclusive
• f5 big-ip application acceleration manager12.1.0 and later · up to 12.1.5 inclusive
• f5 big-ip application acceleration manager14.0.0 and later · up to 14.1.2 inclusive
• f5 big-ip application acceleration manager15.0.0 and later · up to 15.1.0 inclusive
• f5 big-ip application acceleration manager11.5.1 and later · up to 11.6.5 inclusive
• f5 big-ip application acceleration manager13.0.0 and later · up to 13.1.3 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• F5 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager

  • BIG-IP 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, 11.5.2-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, 5.0.0-5.4.0, iWorkflow 2.3.0, Enterprise Manager 3.1.1affected

Other highest-scoring records for the same primary product.

• CVE-2022-41622iControl SOAP vulnerability
  63This week
• CVE-2020-5868In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected
  40Plan
• CVE-2021-23005On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ do
  36Monitor
• CVE-2020-5869In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confiden
  36Monitor
• CVE-2020-5870In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer.
  32Monitor
• CVE-2020-5860On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

To simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1kind: ClusterRole2rules:3  - apiGroups: ["*"]4    resources: ["*"]5    verbs: ["*"]

1kind: Role2metadata:3  namespace: lodos-system4rules:5  - apiGroups: ["apps"]6    resources: ["deployments"]7    verbs: ["get", "list", "update"]

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.