CVE-2022-1388

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 16.1.x, < 16.1.2.2; >= 15.1.x, < 15.1.5.1; >= 14.1.x, < 14.1.4.6; >= 13.1.x, < 13.1.5; >= 12.1.x, <= 12.1.6; >= 11.6.x, <= 11.6.5

References

http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://support.f5.com/csp/article/K23605346Mitigation, Vendor Advisory
https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/Exploit, Mitigation, Third Party Advisory
http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://support.f5.com/csp/article/K23605346Mitigation, Vendor Advisory
https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/Exploit, Mitigation, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1388US Government Resource

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: May 10, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-13894.3On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu CVE-2022-13909.8The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe CVE-2022-13919.8The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic CVE-2022-13927.5The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could le CVE-2022-13935.4The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle i CVE-2022-13944.8The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high CVE-2022-13954.8The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users CVE-2022-13964.8The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, lead CVE-2022-13978.8API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.CVE-2022-13986.5The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via UR CVE-2022-13999.1An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMD CVE-2022-14009.8Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Ap