CVE-2022-41983
BIG-IP TMM Vulnerability CVE-2022-41983
Reported by f5 · Published October 19, 2022
On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| big-ip_policy_enforcement_manager | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_advanced_web_application_firewall | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_carrier-grade_nat | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_advanced_firewall_manager | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_local_traffic_manager | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_edge_gateway | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_application_acceleration_manager | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_application_visibility_and_reporting | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_global_traffic_manager | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| big-ip_ssl_orchestrator | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
| BIG-IP | F5 | 16.1.3.1, 15.1.7, 14.1.5.1 |
| big-ip_ddos_hybrid_defender | f5 | 16.1.3.1, 15.1.7, 14.1.5.1, 13.1.5 |
8 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| F5 | BIG-IP | 17.0.0, 16.1.x, 15.1.x |
| F5 | BIG-IP | 15.1.x, 17.0.0, 16.1.x |
Timeline
- Oct 19, 2022 CVE Published
- Oct 22, 2022 EPSS Score (30 in total, the first dated here)
- May 8, 2025 CVE Updated
- Mar 30, 2026 Security Advisory (3 in total, the first dated here)
- Jun 15, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-41983
vulnetix vdb fixes CVE-2022-41983Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-41983/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart