#VU51493 OS Command Injection in F5 Networks products - CVE-2021-22987
Published: March 16, 2021
Vulnerability identifier: #VU51493
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2021-22987
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
BIG-IP
BIG-IP DDHD
BIG-IP SSLO
BIG-IP LTM
BIG-IP AFM
BIG-IP Analytics
BIG-IP APM
BIG-IP ASM
BIG-IP FPS
BIG-IP GTM
BIG-IP PEM
BIG-IP AAM
BIG-IP DNS
BIG-IP Link Controller
BIG-IP Advanced WAF
BIG-IP
BIG-IP DDHD
BIG-IP SSLO
BIG-IP LTM
BIG-IP AFM
BIG-IP Analytics
BIG-IP APM
BIG-IP ASM
BIG-IP FPS
BIG-IP GTM
BIG-IP PEM
BIG-IP AAM
BIG-IP DNS
BIG-IP Link Controller
BIG-IP Advanced WAF
Software vendor:
F5 Networks
F5 Networks
Description
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the Traffic Management User Interface (TMUI) when running in Appliance mode. A remote authenticated user with network access to the Configuration utility, through the BIG-IP management port, or self IP addresses can send specially crafted request and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install updates from vendor's website.