{"id":"CVE-2022-41800","published":"2022-12-07T03:12:17Z","modified":"2025-04-23T13:33:29Z","title":"Appliance mode iControl REST vulnerability","vendor":"F5","product":"BIG-IP","tier":"core","eol":null,"affectedVersions":[{"vendor":"F5","product":"BIG-IP","versions":["17.0.x","16.1.x","15.1.x","14.1.x","13.1.x"]}],"description":{"text":"\nIn all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an Appliance mode restriction bypass in the iControl REST interface of F5 BIG-IP, which lets a user escape the limits that Appliance mode imposes on the system. An attacker needs network access to the iControl REST interface and must already hold valid credentials with the Administrator role; no user interaction is required, and successful exploitation allows them to cross a security boundary, which the advisory ties to an undisclosed endpoint.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:37Z"},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.76866,"percentile":0.99547,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-12-13","exploitedFirstSeen":"2023-12-13","ransomware":false,"evidence":[{"url":"https://www.labs.greynoise.io/grimoire/2023-12-14-if-youre-going-to-spray-my-exploit/","date":"2023-12-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-04&host_type=src&vulnerability=cve-2022-41800","date":"2025-03-04"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Rewterz Threat Alert – Hive Ransomware – Active IOCs | Rewterz","url":"https://otx.alienvault.com/pulse/637da944f4ff4118b1d2b4ea","created":"2022-11-23"},{"name":"ACTUALIZACION | Modo de dispositivo iControl REST vulnerabilidad CVE-2022-41800","url":"https://otx.alienvault.com/pulse/637a5d154b4bca7c44e6d7c3","created":"2022-11-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://support.f5.com/csp/article/K13325942","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-44968","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44968","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"F5 BIG-IP iControl Authenticated RCE via RPM Creator","module":"exploit/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800","type":"exploit","disclosureDate":"2022-11-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800.rb"}],"nuclei":[{"id":"CVE-2022-41800","name":"F5 BIG-IP Appliance Mode - Command Injection","severity":"high","path":"http/cves/2022/CVE-2022-41800.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41800.yaml"}],"first":{"date":"2022-11-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-11-16","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800.rb","provenance":"source"},{"date":"2022-12-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-41800","provenance":"source"},{"date":"2023-12-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.labs.greynoise.io/grimoire/2023-12-14-if-youre-going-to-spray-my-exploit/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1053 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9955"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.09,"detail":"base score 8.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}