{"id":"CVE-2022-1388","kind":"vulnerability","aliases":["CVE-2022-1388"],"related":[],"title":"F5 BIG-IP: F5 BIG-IP Missing Authentication Vulnerability","description":"On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","summary":"F5 BIG-IP has a missing authentication flaw in a critical function that lets an unauthenticated remote attacker run code, create or delete files, or disable services. It is listed in CISA's known-exploited catalog and attacks have been observed, with ransomware use tagged.","severity":"critical","cvss":9.8,"epss":0.99954,"exploited":true,"exploited_at":"2022-05-10T00:00:00+00:00","products":[{"name":"F5 BIG-IP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","f5-big-ip","infrastructure","ransomware","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the update per F5's vendor instructions; specific fixed versions are not stated in the sources.","status":"open","published_at":"2022-05-05T17:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:17:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update per F5's vendor instructions; specific fixed versions are not stated in the sources.","reach":"internet","impact":"high","summary":"F5 BIG-IP has a missing authentication flaw in a critical function that lets an unauthenticated remote attacker run code, create or delete files, or disable services. It is listed in CISA's known-exploited catalog and attacks have been observed, with ransomware use tagged.","category":"infrastructure","who_cares":["f5-big-ip","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the appliance and takes it over","analyst_note":"Find the affected and fixed BIG-IP versions and the management-interface exposure check in F5's advisory for CVE-2022-1388 (not in the sources provided).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000465,"input_tokens":2837,"output_tokens":363,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1388':14A,17A '-2022':13A,16A '11.6':113C '12.1':110C '13.1':102C '13.1.5':107C '14.1':96C '14.1.4.6':101C '15.1':90C '15.1.5.1':95C '16.1':84C '16.1.2.2':89C 'attack':50B,71B 'authent':10A,39B,122C 'big':3A,7A,20A,25B,34B,82C 'big-ip':2A,6A,19A,33B,81C 'bypass':119C 'catalog':69B 'cisa':64B 'code':52B 'creat':53B 'critic':43B 'cve':12A,15A 'delet':55B 'disabl':58B 'end':129C 'eot':133C 'evalu':136C 'exploit':22B,68B 'f5':1A,5A,18A,24B,32B,80C 'f5-big-ip':23B 'file':56B 'flaw':40B 'function':44B 'host':31B 'icontrol':120C 'infrastructur':27B 'ip':4A,8A,21A,26B,35B,83C 'known':67B 'known-exploit':66B 'let':46B 'list':62B 'may':118C 'miss':9A,38B 'note':123C 'observ':74B 'prior':87C,93C,99C,105C 'ransomwar':28B,76B 'reach':128C 'remot':49B 'request':117C 'rest':121C 'run':51B 'self':30B 'self-host':29B 'servic':59B 'softwar':124C 'support':132C 'tag':78B 'technic':131C 'unauthent':48B 'undisclos':116C 'use':77B 'version':86C,92C,98C,104C,115C,125C 'vulner':11A 'x':85C,91C,97C,103C,111C,114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-05-05T17:15:10+00:00","kev":{"dateAdded":"2022-05-10","dueDate":"2022-05-31","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f5sirt@f5.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-1388","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1388","severity":null,"published_at":"2022-05-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2022-1388","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1388","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-1388","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1388","severity":null,"published_at":"2022-05-05T17:15:10+00:00","modified_at":"2026-06-17T04:22:20+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}