VDB
CVE-2021-22986
CVE-2021-22986
PUBLISHED
CVSS 9.8 CRITICAL
Reported by f5 · Published March 31, 2021
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| big-ip_fraud_protection_service | f5 | 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
| big-ip_ddos_hybrid_defender | f5 | 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
Risk scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | BIG-IP; BIG-IQ | BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, BIG-IQ 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2 |
| n/a | BIG-IP; BIG-IQ | BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, BIG-IQ 7.1.0.x before 7.1.0.3, 7.0.0.x before 7.0.0.2 |
Timeline
- Mar 11, 2021 PoC Published (168 in total, the first dated here)
- Mar 17, 2021 VulnCheck XDB Entry (12 in total, the first dated here)
- Mar 31, 2021 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Jun 1, 2021 VulnCheck KEV Exploitation (916 in total, the first dated here)
- Nov 3, 2021 CISA KEV Added
- Mar 30, 2026 Security Advisory (11 in total, the first dated here)
- Aug 25, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-22986
vulnetix vdb fixes CVE-2021-22986Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-22986/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- [MàJ] Vulnérabilité dans F5 BIG-IP advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22986 advisory