CVE-2022-1388

F5 BIG-IP is a network appliance used by many companies to manage traffic, security features, and network services. This issue is like someone finding a way to walk past the front-door lock and enter the management area without logging in. Once inside, an attacker can potentially take control or disrupt services.

This matters if you run any F5 BIG-IP products in the affected set (Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager, Domain Name System, Fraud Protection Service) on vulnerable software versions. The finding says it can be reachable in default configuration and does not require login or user interaction. The practical risk is highest if the iControl REST API/management interface is exposed and reachable from the network.

This is RED because CISA has confirmed it was used in ransomware campaigns and added it to the KEV list. Attackers can bypass authentication remotely over the network on vulnerable BIG-IP versions, and public exploits are available. Treat this as an immediate upgrade priority, not a wait-and-see issue.

1. Confirm exposure and versions

• Identify the exact F5 BIG-IP software version(s) on each appliance.
• Determine whether the iControl REST API / management interface is reachable from other networks, especially the internet (the findings state it can be reachable in default configuration).
• If you have multiple BIG-IP units, prioritize those exposed to external networks.

2. Decide whether you are affected

• You are affected if you run vulnerable versions listed in the title summary (16.1.x < 16.1.2.2, 15.1.x < 15.1.5.1, 14.1.x < 14.1.4.6, 13.1.x < 13.1.5, and all 12.1.x and 11.6.x) and the iControl REST API is exposed.

3. Upgrade to a fixed version

• Upgrade to one of the fixed releases: 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, or 13.1.5.
• Follow F5’s upgrade procedure for your platform and keep the change window aligned with your operational constraints.
• Use trusted update sources as stated in the vendor remediation note.

4. Temporary containment/workaround if patching is delayed

• Immediately restrict network access to the management interface (so the iControl REST endpoints are not reachable from untrusted networks).
• Apply any vendor-provided guidance/workaround steps referenced in the advisory materials, but do not treat workarounds as a substitute for upgrading.

5. After patching: verify and monitor

• Confirm the appliance is running the fixed version you selected.
• Validate that external access to the management/API surface is restricted appropriately.
• Watch for suspicious management activity attempts around the iControl REST endpoints, and review logs for any signs of unauthorized access attempt before/around the upgrade window.

6. CISA timing note

• CISA’s KEV remediation due date was 2022-05-31; if you have not already completed the upgrade, treat this as overdue and move immediately.

Severity is critical (CVSS 9.8 in the provided record) with no authentication and no user interaction required, network-based attack surface. The weakness is CWE-306 (missing authentication/authorization bypass). Mechanism: the finding states that specific, undisclosed network requests to the exposed iControl REST API can bypass security checks and grant unauthorized access.

Real-world status: CISA lists CVE-2022-1388 in KEV (added 2022-05-10) with a remediation due date of 2022-05-31, and it is stated to be used in ransomware campaigns. Public exploit availability is also indicated (4 known), which increases practical risk.

Reachability/preconditions from findings: the target must be running a vulnerable BIG-IP version and expose the iControl REST API; the finding also indicates it is reachable in default configuration.

EPSS: a predicted value is provided in the findings, but per instructions it should not be treated as a substitute for KEV/exploitation confirmation (KEV is present and takes precedence).