CVE-2021-22991 is a critical buffer overflow vulnerability affecting F5 BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, and 12.1.x. Undisclosed requests to a virtual server can be mishandled by the Traffic Management Microkernel (TMM) URI normalization, leading to a Denial of Service (DoS) attack. In certain scenarios, this vulnerability could also enable URL-based access control bypass or remote code execution (RCE). With a CVSS score of 9.8 (CRITICAL), it is easily exploitable over the network without authentication and has a high impact on confidentiality, integrity, and availability. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, and has garnered significant community discussion and media coverage, despite the lack of public exploit code on platforms like Metasploit or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.1.0, < 12.1.5.3CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | ||
>= 13.1.0, < 13.1.3.6CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | ||
>= 14.1.0, < 14.1.4CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | ||
>= 15.1.0, < 15.1.2.1CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | ||
>= 16.0.0, < 16.0.1.1CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.