Race Condition Vulnerability in BIG-IP Products by F5 Networks
CVE-2021-22974

7.5HIGH

Key Information:

Vendor

F5
Status
Big-ip, Big-iq
Vendor
CVE Published:
12 February 2021

What is CVE-2021-22974?

A race condition vulnerability has been identified in F5 Networks' BIG-IP products, where an authenticated attacker with access to iControl REST may exploit this flaw to execute commands with elevated privileges. This issue arises from an incomplete resolution of a previously identified vulnerability and affects specific versions of the software. Organizations using affected versions should prioritize applying recommended updates to mitigate this risk and ensure the integrity of their systems.

Affected Version(s)

BIG-IP, BIG-IQ BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x

References

https://support.f5.com/csp/article/K68652018
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.