CVE-2021-22989

highpriority · track · 39EPSS 0.088 · 95 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

8.82% (95th) EPSS

CVSS 9 · high

Is it mine?

155 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

EPSS · scored 2026-10-27

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, when running in Appliance mode with Advanced WAF or BIG-IP ASM provisioned, the TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v2.09highAV:N/AC:L/Au:S/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 8 · impact 10

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.3 · impact 6

v3.19.1criticalAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-264US

affected products (155)

Products and version ranges known to be affected.

n/a BIG-IP Advanced WAF or BIG-IP ASM in Appliance Mode≤ 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3enisa_euvdEU
F5 Networks, Inc. BIG-IP Access Policy Manager12.1.0 → 12.1.5.3fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager13.1.0 → 13.1.3.6fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager14.1.0 → 14.1.4fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager15.1.0 → 15.1.2.1fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager16.0.0 → 16.0.1.1fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager12.1.0 → 12.1.5.3fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager13.1.0 → 13.1.3.6fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager14.1.0 → 14.1.4fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager15.1.0 → 15.1.2.1fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager16.0.0 → 16.0.1.1fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Web Application Firewall12.1.0 → 12.1.5.3fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Web Application Firewall13.1.0 → 13.1.3.6fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Web Application Firewall14.1.0 → 14.1.4fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Web Application Firewall15.1.0 → 15.1.2.1fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Web Application Firewall16.0.0 → 16.0.1.1fstec_bduRU
F5 Networks, Inc. BIG-IP Analytics12.1.0 → 12.1.5.3fstec_bduRU
F5 Networks, Inc. BIG-IP Analytics13.1.0 → 13.1.3.6fstec_bduRU
F5 Networks, Inc. BIG-IP Analytics14.1.0 → 14.1.4fstec_bduRU
F5 Networks, Inc. BIG-IP Analytics15.1.0 → 15.1.2.1fstec_bduRU

showing 20 of 155

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2021-03-31modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan