Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2022-05-05

Status

Published

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Weaknesses

CWE-306

Coverage 1

malware

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

A new IoT botnet framework, TuxBot v3 Evolution, has been identified, leveraging LLM assistance during development. Developed by an Iranian-based developer, the framework is modular and includes features like DDoS-for-hi…

Palo Alto Unit 42 · Jul 15, 2026

CVE-2022-1388CVE-2022-22965CVE-2020-8515

All articles mentioning it

Advisories and references

• support.f5.com/csp/article/K23605346
• packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution...
• packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Ex...
• packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-...
• secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerabili...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...