CVE-2021-22995 — Missing Authentication for Critical Function in F5 Big-iq Centralized Management

CWE-306 — Missing Authentication for Critical Function9 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 52.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
F5 Big-iq Centralized Management
Timeline
PublishedMar 31
Latest updateMar 25

Description

On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDf5/big-iq_centralized_management6.0.0 — 6.1.0+1
▶CVEListV5f5/big-iq_centralized_managementAll 7.x and 6.x versions

🔴Vulnerability Details

7
OSV
linux-azure, linux-azure-5.4 vulnerabilities↗2024-03-25
▶
OSV
linux-aws, linux-aws-5.4 vulnerabilities↗2024-03-19
▶
OSV
linux-ibm, linux-ibm-5.4, linux-oracle, linux-oracle-5.4 vulnerabilities↗2024-03-13
▶
OSV
linux-bluefield, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities↗2024-03-11
▶
OSV
linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-iot, linux-kvm, linux-raspi vulnerabilities↗2024-03-06
▶

📋Vendor Advisories

1
F5
CVE-2021-22995: On all 7↗2021-03-31
▶
CVE-2021-22995 — F5 vulnerability | cvebase