CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
Description
CVE-2022-1388 is a critical authentication bypass vulnerability in F5 BIG-IP that allows unauthenticated remote code execution, file creation or deletion, and service disruption. The vulnerability exists due to a missing authentication check in a critical function of the iControl REST API, enabling attackers to bypass authentication entirely and execute arbitrary system commands with root privileges. CISA has confirmed active exploitation and included CVE-2022-1388 in the Known Exploited Vulnerabilities (KEV) catalog with a known ransomware association. With an EPSS percentile of 99.99%, this is among the most actively exploited network infrastructure vulnerabilities, posing a critical threat to any organization running affected BIG-IP versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip advanced firewall manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip analytics | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip application acceleration manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip application security manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip domain name system | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip fraud protection service | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip global traffic manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip link controller | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip local traffic manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
| f5 | big-ip policy enforcement manager | >= 11.6.1, <= 11.6.5; >= 12.1.0, <= 12.1.6; >= 13.1.0, < 13.1.5; >= 14.1.0, < 14.1.4.6; >= 15.1.0, < 15.1.5.1; >= 16.1.0, < 16.1.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.f5.com/csp/article/K23605346(Mitigation, Vendor Advisory)
- https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/(Exploit, Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CWE-306 describes a weakness where a product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. In CVE-2022-1388, F5 BIG-IP's iControl REST API fails to enforce authentication on a critical management function, allowing any network-reachable attacker to execute administrative commands without providing valid credentials.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2022-1388 is a missing authentication vulnerability in F5 BIG-IP that enables unauthenticated remote code execution with root privileges. The vulnerability is remotely exploitable from the network without any authentication, special privileges, or user interaction. F5 BIG-IP is widely deployed as a load balancer, SSL terminator, and application delivery controller in enterprise environments, often positioned at critical network junctions where it processes all inbound and outbound traffic for web applications. Successful exploitation allows an attacker to execute arbitrary system commands with root access, create or delete files, disable services, and potentially pivot into the internal network. The EPSS percentile of 99.99% confirms near-certain exploitation activity. The confirmed ransomware association in the CISA KEV catalog further escalates the threat — ransomware operators leverage compromised BIG-IP devices to gain deep network access for deploying ransomware across the enterprise. Compromise of a BIG-IP device is particularly devastating because it provides visibility into and control over all traffic flowing through the load balancer, including potentially decrypted HTTPS traffic.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-1388 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 31, 2022 — an unusually short timeline reflecting the extreme urgency. The KEV catalog flags this vulnerability with a known ransomware association. The EPSS percentile of 99.99% places it among the most exploited vulnerabilities in existence. Public proof-of-concept exploit code was published within days of disclosure, and mass exploitation campaigns were observed almost immediately. The exploit is trivially simple — a single HTTP request with a specific header manipulation bypasses the iControl REST API authentication, allowing unauthenticated execution of arbitrary bash commands as root. Multiple threat actors were documented exploiting this vulnerability for data theft, webshell deployment, cryptocurrency mining, and ransomware staging. The combination of trivial exploitability, critical infrastructure targeting, and ransomware association makes CVE-2022-1388 one of the most dangerous vulnerabilities disclosed in 2022.
Remediation
- Update F5 BIG-IP to a version that contains the fix for CVE-2022-1388 as specified in F5's security advisory. CISA mandates remediation by May 31, 2022.
- If immediate patching is not possible, apply F5's recommended mitigations: block iControl REST access through the self IP address, block iControl REST access through the management interface, and modify the BIG-IP httpd configuration to restrict access.
- Never expose the BIG-IP management interface or iControl REST API to the public internet. Restrict management access to a dedicated management network segment accessible only from authorized administrative systems.
- Review BIG-IP logs for indicators of exploitation, including unauthorized command execution, unexpected file creation or deletion, new user account creation, or unusual iControl REST API activity.
- If exploitation is suspected, treat the BIG-IP device as fully compromised — rebuild from a known-good image, rotate all credentials stored on or accessible through the device, and review all traffic configurations for unauthorized modifications.
Technical Details
CVE-2022-1388 exploits a critical authentication bypass in F5 BIG-IP's iControl REST API, which is the primary programmatic management interface for BIG-IP devices. The vulnerability exists because the iControl REST API fails to properly enforce authentication when requests include a specific combination of HTTP headers that cause the authentication check to be skipped. Specifically, by manipulating the Connection and X-F5-Auth-Token headers in an HTTP request to the iControl REST API endpoint, an attacker can cause the request to bypass the normal authentication pipeline entirely. Once authentication is bypassed, the attacker can invoke the /mgmt/tm/util/bash endpoint to execute arbitrary bash commands with root privileges on the BIG-IP system. The root cause is related to how the Apache reverse proxy configuration on BIG-IP handles certain hop-by-hop headers — the attacker's header manipulation causes the authentication token validation to be skipped while still allowing the request to reach the backend API handler. The attack requires only a single HTTP request and no prior knowledge of credentials, making it one of the simplest and most powerful network infrastructure exploits.
Frequently Asked Questions
Is CVE-2022-1388 being actively exploited?
Yes, CVE-2022-1388 is being massively exploited with confirmed ransomware association. CISA has included it in the KEV catalog with an urgent May 2022 deadline, and its EPSS percentile of 99.99% confirms it is among the most exploited vulnerabilities. Mass exploitation began almost immediately after public disclosure.
What products are affected by CVE-2022-1388?
CVE-2022-1388 affects F5 BIG-IP devices across multiple product versions. The vulnerability is in the iControl REST API, which is present on all BIG-IP platforms. Consult F5's security advisory for the specific affected versions and upgrade paths.
How do I fix CVE-2022-1388?
Update F5 BIG-IP to the patched version immediately. If patching is delayed, apply F5's recommended mitigations to restrict iControl REST API access. Never expose the management interface to the public internet. If compromise is suspected, rebuild the device from a known-good image.
How severe is CVE-2022-1388?
CVE-2022-1388 is a critical authentication bypass with an EPSS percentile of 99.99% and confirmed ransomware association. It allows unauthenticated root-level command execution on BIG-IP devices that serve as critical network infrastructure. Compromise enables complete network traffic interception and lateral movement.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.