CVE-2022-41813

published 2022-10-19

CVE-2022-41813: In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM…

Priority P4 34 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module, an undisclosed input can cause Traffic Management Microkernel (TMM) to terminate.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip_advanced_firewall_manager	13.1.0 – 13.1.5	—
f5	big-ip_advanced_firewall_manager	>= 14.1.0 < 14.1.5	14.1.5
f5	big-ip_advanced_firewall_manager	>= 15.1.0 < 15.1.6.1	15.1.6.1
f5	big-ip_advanced_firewall_manager	>= 16.1.0 < 16.1.3.1	16.1.3.1
f5	big-ip_afm	—	—
f5	big-ip_afm_pem	>= 13.1.0 < 13.1.x*	13.1.x*
f5	big-ip_afm_pem	>= 14.1.x < 14.1.5	14.1.5
f5	big-ip_afm_pem	>= 15.1.x < 15.1.6.1	15.1.6.1
f5	big-ip_afm_pem	>= 16.1.x < 16.1.3.1	16.1.3.1
f5	big-ip_pem	—	—
f5	big-ip_policy_enforcement_manager	13.1.0 – 13.1.5	—
f5	big-ip_policy_enforcement_manager	>= 14.1.0 < 14.1.5	14.1.5
f5	big-ip_policy_enforcement_manager	>= 15.1.0 < 15.1.6.1	15.1.6.1
f5	big-ip_policy_enforcement_manager	>= 16.1.0 < 16.1.3.1	16.1.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20