CVE-2021-22986

This is a flaw in the “management web door” (iControl REST) that BIG-IP/BIG-IQ uses for configuration and administration. If that door is reachable, an attacker can send crafted requests and make the device run commands—without needing an account—like getting a skeleton key to the server itself. In practice, that can mean full control of the device that protects your business network.

This matters if your small business uses F5 BIG-IP or BIG-IQ appliances (including the BIG-IP components listed) to handle security and traffic management. It’s most relevant when the iControl REST interface is exposed and reachable over the network in your environment. Also, because exploitation does not require authentication, you’re at risk as soon as an attacker can reach the vulnerable management endpoint from where they shouldn’t be (often the internet, depending on your network setup).

This is RED because it enables unauthenticated remote command execution, and it’s already listed in CISA’s Known Exploited Vulnerabilities database with evidence of use in ransomware campaigns. Time matters: if your iControl REST is reachable and you’re on a vulnerable F5 version, attackers can directly take control without needing a username or password.

1. Identify where the vulnerable software runs:

   • For each F5 appliance you manage, record the product type (BIG-IP vs BIG-IQ and which BIG-IP module, if applicable) and the exact version.
   • Confirm whether the iControl REST interface is enabled.

2. Check reachability (who can access the management endpoint):

   • Determine which networks can reach iControl REST (public internet, partner networks, internal subnets).
   • Review firewall rules, security groups, and any reverse proxies/NAT that might expose iControl REST externally.

3. Decide if you’re affected:

   • BIG-IP: vulnerable in the ranges described (for example, 12.1.x is vulnerable before 12.1.5.3, and other branches are vulnerable before their respective fixed builds).
   • BIG-IQ: vulnerable in the ranges described (for example, 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2).

4. Upgrade to the fixed versions (primary remediation):

   • BIG-IP branches listed in the findings are fixed in 12.1.5.3.
   • BIG-IQ should be upgraded using the vendor guidance for the correct branch (follow F5 vendor remediation instructions).

   Vendor remediation reference: https://support.f5.com/csp/article/K03009991

5. Temporary containment if patching is delayed:

   • Immediately restrict network access to iControl REST so it is reachable only from trusted administration networks (or disable/expose it only via controlled access paths).
   • Ensure it is not accessible from the internet or from untrusted segments.

6. Post-upgrade verification:

   • Recheck the appliance version to confirm the upgrade succeeded.
   • Confirm iControl REST behavior is no longer vulnerable, and that only authorized networks can reach it.

7. What to monitor:

   • Look for unusual management requests targeting iControl REST.
   • Review logs for unexpected command execution patterns or configuration changes.

8. KEV timing:

   • CISA KEV remediation due date was 2021-11-17.

Severity is critical (CWE-918) with a mechanism of unauthenticated remote command execution (RCE) in the iControl REST interface of F5 BIG-IP and BIG-IQ. The attack is network-based and requires no authentication or user interaction; exploitation is possible when the vulnerable iControl REST endpoint is exposed. This vulnerability is listed in CISA KEV with added date 2021-11-03 and is associated with use in ransomware campaigns, which is treated as confirmed real-world exploitation. Public exploits are available, indicating exploit maturity beyond proof-of-concept. Technical targeting depends on reaching the iControl REST service on a BIG-IP/BIG-IQ running a vulnerable version range. Fixed BIG-IP releases are indicated as 12.1.5.3 for the affected BIG-IP modules listed; BIG-IQ requires branch-specific upgrade per F5 remediation guidance.