CVE-2022-25946

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
F5	BIG-IP (Advanced WAF, APM, ASM)	16.1.x; 15.1.x; 14.1.x; 13.1.x; 12.1.x; 11.6.x
F5	BIG-IP Guided Configuration (GC)	>= All, < 9.0

References

https://support.f5.com/csp/article/K52322100Vendor Advisory
https://support.f5.com/csp/article/K52322100Vendor Advisory

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259485.3The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in l CVE-2022-259497.8The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading CVE-2022-259510.0Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.CVE-2022-259528.8Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.CVE-2022-259597.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an CVE-2022-25965.9Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.CVE-2022-259629.8All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.CVE-2022-259667.8Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potent CVE-2022-259678.8Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variable CVE-2022-259697.8The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary CVE-2022-25975.4The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST CVE-2022-259727.8An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead