CVE-2022-25946 Security feature bypass in BIG-IP (Advanced WAF, APM, ASM)

High 8.7 Published 5 May 2022 Updated 17 Sep 2024

Authenticated administrators can bypass Appliance mode restrictions in F5 BIG-IP Guided Configuration due to missing integrity checks.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-25946?

CVE-2022-25946 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 5 May 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Weakness: CWE-354

Which versions are affected by CVE-2022-25946?

It affects 4 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Application Security Manager, F5 Big-Ip Guided Configuration.

How do I fix CVE-2022-25946?

No fix has been published for CVE-2022-25946 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-25946 being exploited?

There is no known exploitation of CVE-2022-25946 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-8j32-qm4m-rqjw.