Vulnerability in F5 Big-Ip
CVE-2022-34862
In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
EPSS: 0.011 (61.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- F5 Big-ip — versions 13.1.0, 14.1.x, 15.1.x
- F5 Big-ip_access_policy_manager
- F5 Big-ip_advanced_firewall_manager
- F5 Big-ip_analytics
- F5 Big-ip_application_acceleration_manager
- F5 Big-ip_application_security_manager
- F5 Big-ip_domain_name_system
- F5 Big-ip_fraud_protection_service
- F5 Big-ip_global_traffic_manager
- F5 Big-ip_link_controller
Weakness classification (CWE)
Public proof-of-concept exploits
References
- f5sirt@f5.com (Exploit, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-34862?
- CVE-2022-34862 is a high-severity vulnerability in F5 Big-Ip, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2022-08-04.
- How severe is CVE-2022-34862?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-34862 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.