CVE-2021-22988
At a glance Severity Not available EPSS EPSS 10.42 % · percentile 96 (2026-10-27) State PUBLISHED Published 2021-03-31 Updated 2024-08-03 Assigner f5 NVD status Modified Description On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C NVD · nvd@nist.gov (Primary)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.2.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.0.0 < 16.0.1.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.6cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.4+44 more Affected products Product Versions BIG-IP affected 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3
References
Sources
