CVE-2021-22986

01/תיאור (מקור, אנגלית)

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

02/מוצרים מושפעים

f5: big-ip access policy manager; f5: big-ip advanced firewall manager; f5: big-ip advanced web application firewall; f5: big-ip analytics; f5: big-ip application acceleration manager; f5: big-ip application security manager; f5: big-ip ddos hybrid defender; f5: big-ip domain name system; f5: big-ip fraud protection service; f5: big-ip global traffic manager; f5: big-ip link controller; f5: big-ip local traffic manager; f5: big-ip policy enforcement manager; f5: big-iq centralized management; f5: ssl orchestrator

03/קישורים7

• support.f5.com/csp/article/K03009991 Vendor Advisory
• support.f5.com/csp/article/K03009991 Vendor Advisory
• packetstormsecurity.com/files/162059/F5-iControl-Server-Side-R‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-C‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/162059/F5-iControl-Server-Side-R‮… ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-C‮… ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve‮… US Government Resource