CVE-2022-1388: F5 BIG-IP iControl REST authentication bypass, unauthenticated RCE
The short version: F5 BIG-IP has an authentication-bypass flaw in its iControl REST management interface (CVE-2022-1388) that lets an unauthenticated attacker execute commands — effectively as root — on the device. It scores 9.8, exploit code is public and trivial, and it's in CISA's KEV catalog with known ransomware use. If a BIG-IP management interface is reachable and unpatched, treat this as urgent. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (F5, CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.96% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-31 |
| Known exploited? | Yes — mass exploitation; associated with ransomware activity |
| Vulnerability type | CWE-306 missing authentication for critical function → iControl REST auth bypass → command execution |
| Requires authenticated session? | No — pre-authentication (the bypass defeats iControl REST authentication) |
| Affected | BIG-IP 16.1.x < 16.1.2.2, 15.1.x < 15.1.5.1, 14.1.x < 14.1.4.6, 13.1.x < 13.1.5; all 12.1.x and 11.6.x are End-of-Technical-Support (upgrade — not evaluated) |
| Fixed in | 16.1.2.2 · 15.1.5.1 · 14.1.4.6 · 13.1.5 (or later) |
What you need to know
F5 BIG-IP is a widely deployed application-delivery and security appliance, and it's administered through an iControl REST management interface. CVE-2022-1388 lets certain undisclosed requests bypass iControl REST authentication entirely — and because that interface can run system commands, the bypass turns directly into command execution on the device.
This is about as bad as external exposure gets, and the target makes it worse:
- It's the appliance itself. Command execution on a BIG-IP means the attacker controls a device that sits in the traffic path and often has broad reach.
- It's pre-authentication and trivially exploitable. No credential, and reliable public exploits appeared almost immediately after disclosure.
- It was mass-exploited. BIG-IP has been a recurring ransomware and intrusion target; an exposed, unpatched device is actively hunted.
How serious we see it
High — the 9.8 is not hyperbole. Unauthenticated, network-reachable command execution on a management interface, with public exploits and confirmed mass exploitation, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific BIG-IP builds, the fixes are long published, and the single most effective control — keeping the management interface off the public internet — is entirely in your hands. F5's guidance has always been that the BIG-IP management interface should not be internet-facing.
Recommendations
Straight from F5's advisory (K23605346) and CISA:
- Patch now. Upgrade to 16.1.2.2 / 15.1.5.1 / 14.1.4.6 / 13.1.5 or later. 12.1.x and 11.6.x have reached End of Technical Support — migrate to a supported branch.
- Get the management interface off the internet. Restrict iControl REST / TMUI management access to trusted networks or a jump host — this defeats remote exploitation even before patching.
- Apply F5's mitigations if you can't patch immediately. Follow F5's guidance to restrict access via self-IPs and the management port.
- Hunt. Review logs for unauthenticated
bash/iControl REST requests and unexpected command execution. - If compromised, respond fully. Rebuild the device, and rotate credentials, keys, and certificates it handled.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing F5 BIG-IP management and login interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV.
The whole point of a continuous, attacker's-eye view is catching the exposure that shouldn't exist: a BIG-IP management interface reachable from the internet is exactly what this bug needs, and it's exactly what BreachRisk surfaces before someone else finds it.