Privilege escalation in F5 Big-Ip
CVE-2022-33962
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (8.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- F5 Big-Ip — versions 13.1.0, 14.1.x, 15.1.x
- F5 Big-Ip Access Policy Manager — versions 17.0.0
- F5 Big-Ip Advanced Firewall Manager — versions 17.0.0
- F5 Big-Ip Analytics — versions 17.0.0
- F5 Big-Ip Application Acceleration Manager — versions 17.0.0
- F5 Big-Ip Application Security Manager — versions 17.0.0
- F5 Big-Ip Domain Name System — versions 17.0.0
- F5 Big-Ip Fraud Protection Service — versions 17.0.0
- F5 Big-Ip Global Traffic Manager — versions 17.0.0
- F5 Big-Ip Link Controller — versions 17.0.0
Weakness classification (CWE)
References
- support.f5.com/csp/article/K80970653 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-33962?
- CVE-2022-33962 is a medium-severity vulnerability in F5 Big-Ip, classified under Improper Privilege Management. CVSS score: 6.7/10. Published 2022-08-04.
- How severe is CVE-2022-33962?
- Medium severity. CVSS v3 base score is 6.7 out of 10.