CVE-2022-41617CWE-77

BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

High · published October 19, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01409 · 72.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2022-10-19T21:19Z
EPSS history
Timeline
  • 19 OCT 21:19Z
    BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617
    cvelistv5