Remote File Access Vulnerability in F5 BIG-IP and BIG-IQ Products
CVE-2022-26340

4.9MEDIUM

Key Information:

Vendor
F5
Status
Big-ip
Big-iq Centralized Management
Vendor
CVE Published:
5 May 2022

Summary

An authenticated, high-privileged attacker without bash access may gain unauthorized access to sensitive Certificate and Key files on F5 BIG-IP and BIG-IQ systems via the Secure Copy (SCP) protocol. This vulnerability affects multiple versions of F5 BIG-IP and BIG-IQ products, allowing potential exploitation that can compromise the security of managed systems. It is critical for organizations using affected versions to implement necessary updates and closely monitor for suspicious activity.

Affected Version(s)

BIG-IP 12.1.x

BIG-IP 11.6.x

BIG-IP 16.1.x < 16.1.2.2

References

https://support.f5.com/csp/article/K38271531
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to F5 by a source that chooses to remain anonymous.
.