CVE-2022-41617 HIGH

CVE-2022-41617: BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

Vendor F5
Product BIG-IP Advanced WAF & ASM
Weakness CWE-77
Published October 19, 2022
Last update May 8, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.

Key dates

02Disclosure timeline

October 19, 2022 CVE published
May 8, 2025 Record updated