# MA-837.062022: MyCERT Alert - BIG-IP iControl REST Critical Vulnerability

**Date:** 08 Jun 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-837.062022  
**Advisory ID:** MA-837.062022

---

**1.0 Introduction**
F5 has released security advisories on vulnerabilities affecting multiple products, including various versions of BIG-IP. Included in the release is an advisory for CVE-2022-1388, which allows undisclosed requests to bypass the iControl REST authentication in BIG-IP. An attacker could exploit CVE-2022-1388 to take control of an affected system.
**2.0 Impact**
This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services.
**3.0 Affected System and Devices**
The vulnerability affecting the following versions of F5 BIG-IP:
• 16.1.x versions prior to 16.1.2.2 
• 15.1.x versions prior to 15.1.5.1 
• 14.1.x versions prior to 14.1.4.6 
• 13.1.x versions prior to 13.1.5 
• All 12.1.x and 11.6.x versions
With the exception of 12.1.x and 11.6.x, F5 provided a fix for CVE-2022-1388 in v17.0.0, v16.1.2.2, v15.1.5.1, v14.1.4.6, and v13.1.5. The 12.x and 11.x branches will not receive a patch because these versions have reached end of life [EOL].
**4.0 Recommendations**
MyCERT encourages users and administrators to review the F5 webpage and apply the necessary updates or workarounds. Kindly refer to the below URL for more details:
• <https://support.f5.com/csp/article/K23605346>
• <https://support.f5.com/csp/article/K55879220>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1) <https://www.cisa.gov/uscert/ncas/current-activity/2022/05/04/f5-releases-security-advisories-addressing-multiple>
2) <https://www.cisa.gov/uscert/ncas/alerts/aa22-138a>
3) <https://support.f5.com/csp/article/K23605346>
4) <https://support.f5.com/csp/article/K55879220>
5) <https://www.bleepingcomputer.com/news/security/f5-warns-of-critical-big-ip-rce-bug-allowing-device-takeover/>