CVE-2021-22986 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03
The iControl REST interface in F5 BIG-IP and BIG-IQ Centralized Management contains an unauthenticated remote command execution vulnerability. Attackers with network access can execute system commands, manage files, and disable services without authentication.
Yes. CVE-2021-22986 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2021-22986?
Critical severity, with a CVSS score of 9.8, published 3 November 2021.
Which products and versions are affected?
F5 BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3; F5 BIG-IQ Centralized Management 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2.
Is there a fix for CVE-2021-22986?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-22986 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-22986?
Check whether you run F5 BIG-IP or F5 Big-Iq Centralized Management. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
F5 BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3
F5 BIG-IQ Centralized Management 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2
Timeline
2021-03-10: disclosed: Initial NIST analysis date recorded in change history
2021-11-03: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog
2021-11-03: advisory: Publication date of the advisory