Sploitus

CVE-2022-41622

6 known exploits for CVE-2022-41622

In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products
Big-Ip, Big-Iq Centralized Management
f5 Big-iq Centralized Management
≤ 8.2.0, 7.1.0
CVSS 3.1
8.8 HIGH
EPSS
88.0% (100th percentile)
Weakness
CWE-352
NVD status
Modified
Published
2022-12-07
CVE-2022-41622 at NVD
Authoritative description, scoring and affected products

6 known exploits for CVE-2022-41622

Proof-of-concept code and exploit modules indexed by Sploitus

F5 Big-IP Create Administrative User Exploit
2023-02-03 metasploitZDTRuby
F5 Big-IP Create Administrative User
2023-02-03 Ron Bowes, metasploit.comPACKETSTORMRuby
F5 BIG-IP iControl Remote Command Execution
2022-11-24 Ron Bowes, metasploit.comPACKETSTORMRuby
F5 BIG-IP iControl Cross Site Request Forgery Exploit
2022-11-21 Ron BowesZDTRuby
F5 BIG-IP iControl Cross Site Request Forgery
2022-11-21 Ron Bowes, metasploit.comPACKETSTORMRuby
Exploit for Cross-Site Request Forgery (CSRF) in F5 Big-Iq_Centralized_Management
2022-08-03 rbowes-r7GITHUB