CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
Description
CVE-2021-22986 is a CRITICAL remote code execution vulnerability in F5 BIG-IP and BIG-IQ Centralized Management iControl REST interface, carrying a CVSS 3.1 score of 9.8. The iControl REST interface contains an unauthenticated remote command execution vulnerability that allows attackers with network access to execute arbitrary system commands, create or delete files, and disable services. Affected products include F5 BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, as well as BIG-IQ versions 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.94485 (99.99th percentile), this vulnerability demonstrates the highest levels of real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip advanced firewall manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip advanced web application firewall | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip analytics | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip application acceleration manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip application security manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip ddos hybrid defender | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip domain name system | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip fraud protection service | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip global traffic manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip link controller | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip local traffic manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-ip policy enforcement manager | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
| f5 | big-iq centralized management | >= 6.0.0, < 6.1.0; >= 7.0.0, < 7.0.0.2; >= 7.1.0, < 7.1.0.3 |
| f5 | ssl orchestrator | >= 12.1.0, < 12.1.5.3; >= 13.1.0, < 13.1.3.6; >= 14.1.0, < 14.1.4; >= 15.1.0, < 15.1.2.1; >= 16.0.0, < 16.0.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.f5.com/csp/article/K03009991(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22986(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2021-22986 is classified under CWE-918 — Server-Side Request Forgery (SSRF). This weakness occurs when a web application fetches a remote resource without properly validating the user-supplied URL. An attacker can abuse this to force the server to make requests to unintended destinations, potentially accessing internal services, cloud metadata endpoints, or other resources that are not directly accessible from the external network. SSRF vulnerabilities are particularly dangerous in cloud environments and network management systems.
In the context of the F5 BIG-IP iControl REST interface, the SSRF vulnerability is leveraged to achieve unauthenticated remote command execution. The iControl REST API is a critical management interface used for programmatic configuration and management of BIG-IP devices. By exploiting the SSRF flaw, attackers can bypass authentication mechanisms and reach internal endpoints that process commands with elevated privileges, effectively converting a request forgery vulnerability into full remote code execution.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-22986 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants attackers complete access to the BIG-IP and BIG-IQ management plane, exposing all configuration data including credentials, certificates, keys, and detailed network infrastructure information. The iControl REST interface provides programmatic access to all device settings.
Integrity (HIGH): Attackers can execute arbitrary system commands, create or delete files, modify device configurations, and install persistent backdoors. Through the iControl REST API, attackers can alter traffic policies, load balancing rules, and security configurations across the entire BIG-IP infrastructure.
Availability (HIGH): Attackers can disable services, disrupt traffic management, and render BIG-IP and BIG-IQ devices inoperable. Complete denial of service to all applications and services managed by the compromised device is achievable.
With an EPSS score of 0.94485 (99.99th percentile), this vulnerability ranks among the most exploited vulnerabilities tracked globally, demanding the highest priority for remediation.
Exploit Maturity
CVE-2021-22986 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited since shortly after its disclosure in March 2021. Multiple public exploit codes are available, including Metasploit modules and standalone proof-of-concept scripts. The EPSS score of 0.94485 (99.99th percentile) reflects extensive real-world exploitation.
Ransomware association: CVE-2021-22986 has been confirmed as associated with ransomware campaigns. Threat actors have targeted the iControl REST interface as an initial access vector to deploy ransomware within enterprise networks.
Attack surface: The iControl REST interface is typically accessible on the management port (443) and may also be exposed on self-IP addresses. Multiple exploit frameworks include modules for this vulnerability. Automated scanning for vulnerable instances has been widely observed.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. The urgency reflects the critical nature of the vulnerability and its active exploitation.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the F5 security advisory at support.f5.com/csp/article/K03009991 for specific patch guidance. Update to BIG-IP 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 or later, and BIG-IQ 7.1.0.3 or 7.0.0.2 or later.
- Restrict iControl REST interface access. Block access to the iControl REST API from untrusted networks. Ensure the management interface is only accessible from dedicated management VLANs with strict access controls.
- Identify all affected devices. Inventory all BIG-IP and BIG-IQ Centralized Management instances across your environment. Check version numbers against the affected version ranges to ensure complete coverage.
- Investigate for prior compromise. Review logs for exploitation indicators, including unusual iControl REST API requests, unexpected file creation, and unauthorized configuration changes. Conduct forensic analysis on any devices that were exposed.
- Implement defense-in-depth measures. Deploy network-level access controls, enable detailed audit logging on all management interfaces, and monitor for anomalous API activity patterns.
- Update security monitoring and detection. Ensure IDS/IPS signatures, SIEM rules, and endpoint detection tools are configured to detect exploitation attempts targeting the iControl REST interface.
Technical Details
CVE-2021-22986 is a CRITICAL-severity vulnerability in the F5 BIG-IP and BIG-IQ iControl REST interface. The attack complexity is low, requiring no specialized conditions. No authentication or privileges are required, and no user interaction is needed.
Technical mechanism: The vulnerability exists in the iControl REST interface, which provides a RESTful API for managing BIG-IP devices. Through server-side request forgery (SSRF), unauthenticated attackers can craft HTTP requests that bypass the authentication layer and reach internal REST endpoints that execute system commands with elevated privileges. The flaw allows attackers to execute arbitrary system commands, create or delete files, and disable services on the target device.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-based attack requiring no privileges, no user interaction, with low complexity and maximum impact across confidentiality, integrity, and availability.
Affected versions: BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3. BIG-IQ 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2.
Frequently Asked Questions
Is CVE-2021-22986 being actively exploited?
Yes, CVE-2021-22986 has been actively exploited since its disclosure in March 2021. It is listed in CISA's KEV catalog with an EPSS score of 0.94485 (99.99th percentile). Multiple public exploits are available and the vulnerability has been used in ransomware campaigns targeting enterprise networks.
What products are affected by CVE-2021-22986?
Affected products include F5 BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 across all modules. Additionally, BIG-IQ Centralized Management versions 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2 are affected.
How do I fix CVE-2021-22986?
Update to the latest patched versions: BIG-IP 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3; BIG-IQ 7.1.0.3 or 7.0.0.2. Restrict iControl REST interface access to trusted management networks only. Consult the F5 security advisory K03009991 for detailed guidance.
How severe is CVE-2021-22986?
CVE-2021-22986 is rated CRITICAL with a CVSS 3.1 score of 9.8. It enables fully unauthenticated remote command execution with no user interaction required. The EPSS score of 0.94485 (99.99th percentile) confirms it is among the most exploited vulnerabilities globally. It has confirmed ransomware associations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.