F5 addresses critical vulnerabilities in BIG-IP and BIG

F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability (CWE-863, improper authorization check) in the iControl REST interface. An unauthenticated attacker with network access to the REST endpoint can send crafted requests to execute arbitrary system commands, create or delete files, and disable services on the appliance or virtual instance. Successful exploitation effectively gives the attacker command-level control of the underlying F5 system, which is sufficient for account creation, persistence, lateral movement, and ransomware staging. Any organization running affected BIG-IP or BIG-IQ releases is exposed, particularly where the management interface or iControl REST is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, EPSS places the 30-day exploitation probability at 99.9% (top percentile), though no public PoC is cataloged.

Do: Upgrade BIG-IP and BIG-IQ to the fixed releases identified in F5's advisory (K03051234) on an urgent basis, since exploitation is in the wild and ransomware actors use this flaw. Until patched, restrict network access to the management interface and iControl REST to trusted administration networks. Because ransomware use is known, review affected devices for indicators of compromise such as unexpected commands, created or deleted files, and disabled services.

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVE-2021-22991 is a buffer overflow (CWE-119) in the URI normalization routine of F5 BIG-IP's Traffic Management Microkernel (TMM), the core component that processes traffic for all BIG-IP modules. It is triggered when undisclosed requests sent to a virtual server are incorrectly handled by TMM, causing a buffer overflow that typically results in a denial-of-service; in certain situations it may theoretically allow bypass of URL-based access controls or remote code execution. An unauthenticated, remote attacker (AV:N/PR:N/UI:N, CVSS 9.8) can reach the flaw simply by sending crafted requests to an affected virtual server. Organizations running BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, or 12.1.x prior to the fixed releases are affected, including all listed BIG-IP modules (LTM, DNS, ASM, APM, AFM, AWAF, and others); versions past End of Software Development are not evaluated. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-01-18, and EPSS places it in the 99th percentile (61.1% chance of exploitation within 30 days), though no public PoC is known.

Do: Upgrade affected BIG-IP systems to 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 (or later) as applicable, per the vendor's instructions, as this is a CISA KEV requirement. Audit virtual servers exposed to untrusted traffic, since crafted requests to a virtual server are the trigger, and note that any BIG-IP modules on End-of-Software-Development branches are not evaluated and should be migrated. Because impact can include traffic-handling DoS and, in some situations, URL-based access control bypass or RCE, treat internet-facing BIG-IP appliances as priority targets for patching.