Description
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BIG-IP; BIG-IQ | BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, BIG-IQ 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
F5 iControl REST Unauthenticated SSRF Token Generation RCE
exploit/linux/http/f5_icontrol_rest_ssrf_rce
Exploit-DB 1
- F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated) EDB-49738 · webapps · Apr 2, 2021
GitHub 15 repositories · most starred shown
-
Al1ex/CVE-2021-22986 ★ 90 · Mar 22, 2021
CVE-2021-22986 & F5 BIG-IP RCE
-
dorkerdevil/CVE-2021-22986-Poc ★ 51 · Mar 17, 2021
This is a Poc for BIGIP iControl unauth RCE
-
S1xHcL/f5_rce_poc ★ 26 · Mar 19, 2021
cve-2021-22986 f5 rce 漏洞批量检测 poc
-
Tas9er/CVE-2021-22986 ★ 13 · Mar 29, 2021
Code By:Tas9er / F5 BIG-IP 远程命令执行漏洞
-
west9b/F5-BIG-IP-POC ★ 10 · May 28, 2022
CVE-2020-5902 CVE-2021-22986 CVE-2022-1388 POC集合
-
yaunsky/CVE-202122986-EXP ★ 8 · Mar 26, 2021
F5 BIG-IP远程代码执行；cve-2021-22986，批量检测；命令执行利用
-
safesword/F5_RCE ★ 4 · Mar 21, 2021
CVE-2021-22986 F5 BIG-IP iControl 命令执行漏洞
-
ZephrFish/CVE-2021-22986_Check ★ 3 · Mar 23, 2021
CVE-2021-22986 Checker Script in Python3
-
microvorld/CVE-2021-22986 ★ 0 · Mar 22, 2021
F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE
-
Osyanina/westone-CVE-2021-22986-scanner ★ 0 · Mar 20, 2021
A vulnerability scanner that detects CVE-2021-22986 vulnerabilities.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- F5 iControl REST - Remote Command Execution http/cves/2021/CVE-2021-22986.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.