Loading vulnerability…
CVE-2021-22986 is an unauthenticated remote command execution vulnerability in the iControl REST interface of F5 BIG-IP and BIG-IQ. Affected versions include BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2; additional sources in the provided content also indicate affected BIG-IP 11.6.x and BIG-IQ 6.x branches. The flaw is exposed through the control-plane iControl REST management interface, including the management interface and self IP addresses, not through the data plane. Supporting content indicates exploitation commonly involved bypassing authentication, including via an SSRF step to obtain an authenticated session token, and then invoking authenticated REST endpoints such as /mgmt/tm/util/bash to execute system commands as root. The content also notes an alternative exploit variant that may not require the SSRF step. Successful exploitation can result in full system compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (9 hidden).
This repository contains a Python exploit script (CVE-2021-22986.py) targeting F5 BIG-IP and BIG-IQ devices vulnerable to CVE-2021-22986, a critical unauthenticated remote command execution flaw in the iControl REST API. The exploit works by first attempting to leak or forge an authentication token via the /mgmt/shared/authn/login endpoint. If successful, it uses this token to send commands to the /mgmt/tm/util/bash endpoint, providing the attacker with an interactive shell for arbitrary command execution on the target device. The script is operational and provides a real shell, not just a proof of concept. The README provides a brief description and usage instructions. No hardcoded IPs or domains are present; the script requires the user to supply the target host. The exploit is network-based and requires HTTPS access to the vulnerable API endpoints.
This repository is a collection of Proof-of-Concept (POC) exploits for three critical vulnerabilities affecting F5 BIG-IP devices: CVE-2020-5902, CVE-2021-22986, and CVE-2022-1388. The code is written in Go and consists of four main files: one for each CVE and a main orchestrator (F5.go). The main entry point (F5.go) parses command-line arguments for the target URL and command to execute, then sequentially tests each vulnerability. - CVE-2020-5902 exploit attempts to read the /etc/passwd file via a crafted HTTP GET request, indicating a successful exploit if the file is retrieved. - CVE-2021-22986 and CVE-2022-1388 exploits send crafted HTTP POST requests to the /mgmt/tm/util/bash endpoint, attempting to execute arbitrary shell commands (default is 'id', but customizable via the -c flag). The repository is intended for authorized security research and includes a README with usage instructions and vulnerability descriptions. No hardcoded IPs or domains are present; the user must supply the target URL. The attack vector is network-based, targeting exposed F5 BIG-IP management interfaces over HTTPS.
This repository contains two Python exploit scripts (CVE_2021_22986.py and newpoc.py) targeting CVE-2021-22986, a critical unauthenticated remote command execution vulnerability in F5 BIG-IP and BIG-IQ systems via the iControl REST API. The scripts allow an attacker to: - Check if a target is vulnerable - Execute arbitrary system commands remotely - Obtain a reverse shell on the target - Perform batch scanning of multiple targets The main attack vector is network-based, requiring access to the management interface or self IPs exposing the iControl REST API. The exploit works by sending crafted POST requests to the /mgmt/tm/util/bash endpoint, using a default or hardcoded Authorization header. The newpoc.py script also attempts to extract authentication tokens from /mgmt/shared/authn/login and /mgmt/shared/authz/tokens/ endpoints, but falls back to the same unauthenticated command execution if token extraction fails. The README.md provides detailed usage instructions, affected product versions, and references. The exploit is operational, providing both command execution and reverse shell capabilities, and is suitable for both single-target and batch exploitation scenarios.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iControl REST authentication bypass vulnerability in the F5 BIG-IP product line, mentioned as part of F5's prior security history.
A previously disclosed remote code execution vulnerability in F5 BIG-IP products, mentioned only as historical context.
A vulnerability in F5 BIG-IP/BIG-IQ iControl REST API that allows remote code execution.
An unauthenticated remote code execution vulnerability in the F5 BIG-IP/BIG-IQ iControl REST interface that can lead to complete system compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.