CVE-2022-27806

State: Published
Severity: 8.7 High
Published: May 5, 2022
Updated: Sep 17, 2024
Reserved: Apr 19, 2022

Description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing command injection vulnerabilities in undisclosed URIs in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Scores

CVSS	Score	Vector	Source
3.1	8.7 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N	f5

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
BIG-IP (Advanced WAF, APM, ASM)F5	16.1.xAffected 15.1.xAffected 14.1.xAffected 13.1.xAffected 12.1.xAffected 11.6.xAffected 17.0.0 to before 17.0.x*Not affected
BIG-IP Guided Configuration (GC)F5	All to before 9.0Affected

References

https://support.f5.com/csp/article/K68647001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.