{"id":12789,"date":"2021-03-24T09:25:06","date_gmt":"2021-03-24T09:25:06","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=12789"},"modified":"2026-04-17T18:07:46","modified_gmt":"2026-04-17T18:07:46","slug":"f5-big-ip-big-iq-high-risk-vulnerabilities-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/f5-big-ip-big-iq-high-risk-vulnerabilities-threat-alert\/","title":{"rendered":"F5 BIG-IP\/BIG-IQ High-Risk Vulnerabilities Threat Alert"},"content":{"rendered":"\n

Vulnerability Description<\/h2>\n\n\n\n

On March 11, NSFOCUS observed that F5 released a security bulletin to announce the fix of multiple high-risk vulnerabilities, CVE-2021-22986, CVE-2021-22987, CVE-2021-22988, CVE-2021-22989, CVE-2021-22990, CVE-2021-22991, and CVE-2021-22992, which affect BIG-IP and BIG-IQ in F5.<\/p>\n\n\n\n

Users are advised to take preventive measures as soon as possible.<\/p>\n\n\n\n

BIG-IP is an F5 application delivery platform that integrates the functions of network traffic management, application security management, and load balancing. BIG-IQ is an intelligent framework for managing and orchestrating F5 security and application delivery solutions.<\/p>\n\n\n\n

Reference link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K02566623<\/a><\/p>\n\n\n\n

Description of Major Vulnerabilities<\/h2>\n\n\n\n

iControl REST Remote Command Execution Vulnerability (CVE-2021-22986)<\/strong><\/p>\n\n\n\n

An unauthenticated attacker with network access to the iControl REST interface, through the BIG-IP management interface and his or her IP addresses can execute arbitrary system commands, create or delete files, and disable services. The BIG-IP system in Appliance mode is also vulnerable. This vulnerability has a CVSS score of 9.8.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K03009991<\/a><\/p>\n\n\n\n

TMUI Remote Command Execution Vulnerability (CVE-2021-22987)<\/strong><\/p>\n\n\n\n

In Appliance mode, an authenticated attacker can access TMUI through the BIG-IP management port or his or her IP addresses to complete system compromise and breakout of Appliance mode. This vulnerability can be exploited through the control plane. This vulnerability has a CVSS score of 9.9.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K18132488<\/a><\/p>\n\n\n\n

TMUI Remote Command Execution Vulnerability (CVE-2021-22988)<\/strong><\/p>\n\n\n\n

An authenticated attacker can access TMUI through the BIG-IP management port or his or her IP addresses to create or delete files or disable services. This vulnerability can be exploited through the control plane.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K70031188<\/a><\/p>\n\n\n\n

Appliance Mode Advanced WAF\/ASM TMUI Remote Command Execution Vulnerability (CVE-2021-22989)<\/strong><\/p>\n\n\n\n

When Advanced WAF or ASM is configured in Appliance mode, an attacker with a role of Administrator, Resource Administrator, or Application Security Administrator with access to TMUI through the BIG-IP management port or his or her own IP addresses can execute arbitrary system commands, create or delete files, or disable services.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K56142644<\/a><\/p>\n\n\n\n

Advanced WAF\/ASM TMUI Remote Command Execution Vulnerability (CVE-2021-22990)<\/strong><\/p>\n\n\n\n

On a system configured with Advanced WAF or BIG-IP ASM, an attacker with the role of Administrator, Resource Administrator, or Application Security Administrator with network access to TMUI through the BIG-IP management port or his or her IP address, can execute arbitrary system commands, create or delete files, or disable services.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K45056101<\/a><\/p>\n\n\n\n

TMM  Buffer Overflow Vulnerability (CVE-2021-22991)<\/strong><\/p>\n\n\n\n

Undisclosed requests to a virtual server may be incorrectly handled by Traffic Management Microkernel (TMM) URI normalization. This may trigger a buffer overflow, resulting in a DoS attack. Attackers could exploit this vulnerability through the control plane to allow bypass of URL-based access control or implement remote code execution (RCE) in certain situations. This vulnerability has a CVSS score of 9.0.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K56715231<\/a><\/p>\n\n\n\n

Advanced WAF\/ASM  Buffer Overflow Vulnerability (CVE-2021-22992)<\/strong><\/p>\n\n\n\n

A malicious HTTP response to an Advanced WAF\/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a denial of service (DoS) attack. Attackers could exploit this vulnerability through the data plane and cause remote code execution in certain situations. This vulnerability has a CVSS score of 9.0.<\/p>\n\n\n\n

For details of this vulnerability, visit the following link:<\/p>\n\n\n\n

https:\/\/support.f5.com\/csp\/article\/K52510511<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

CVE-2021-22986:<\/strong><\/p>\n\n\n\n

Affected Versions<\/strong><\/p>\n\n\n\n