BIG-IP: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6,…
Summary
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CISA Known Exploited Vulnerability
- Listed:
- May 10, 2022 · federal remediation due May 31, 2022
- Required action:
- Apply updates per vendor instructions.
- Ransomware use:
- Known
KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.
- 16.1
- 16.1.2.2
- 15.1
- 15.1.5.1
- 14.1
- 14.1.4.6
- 13.1
- 13.1.5
- 12.1
- 11.6
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
- 16.1.2.2
- 15.1.5.1
- 14.1.4.6
- 13.1.5
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation
Mitigation steps weren't captured by the parser for this advisory — this is a parsing gap, not a statement that no fix exists. Read the vendor advisory below for the authoritative guidance.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.