CVE-2022-41800

highpriority · attend · 72EPSS 0.769 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · weaponized

Likely / severe?

76.9% (100th) EPSS

CVSS 8.7 · high

Is it mine?

113 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 2.3 · impact 5.8

v3.18.7highAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nsecondary · f5sirt@f5.comexploitability 2.3 · impact 5.8

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-77USprimaryCWE-77US

exploits (1)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800F5 BIG-IP iControl Authenticated RCE via RPM Creatorweaponized · metasploit

affected products (113)

Products and version ranges known to be affected.

F5 BIG-IP 13.1.0 - 13.1.5all versionscert_bundDEcpe:/a:f5:big-ip:13.1.0_-_13.1.5
F5 BIG-IP 14.1.0 - 14.1.5all versionscert_bundDEcpe:/a:f5:big-ip:14.1.0_-_14.1.5
F5 BIG-IP 15.1.0 - 15.1.8all versionscert_bundDEcpe:/a:f5:big-ip:15.1.0_-_15.1.8
F5 BIG-IP 16.1.0 - 16.1.3all versionscert_bundDEcpe:/a:f5:big-ip:16.1.0_-_16.1.3
F5 BIG-IP 17.0.0all versionscert_bundDEcpe:/a:f5:big-ip:17.0.0
F5 BIG-IP≤ 17.0.xenisa_euvdEU
F5 BIG-IP≤ 16.1.xenisa_euvdEU
F5 BIG-IP≤ 14.1.xenisa_euvdEU
F5 BIG-IP≤ 13.1.xenisa_euvdEU
F5 BIG-IP≤ 15.1.xenisa_euvdEU
F5 Networks, Inc. BIG-IP Access Policy Manager≤ 17.0.0fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager13.1.0 → 13.1.5fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager14.1.0 → 14.1.5fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager15.1.0 → 15.1.8fstec_bduRU
F5 Networks, Inc. BIG-IP Access Policy Manager16.1.0 → 16.1.3fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager≤ 17.0.0fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager13.1.0 → 13.1.5fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager14.1.0 → 14.1.5fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager15.1.0 → 15.1.8fstec_bduRU
F5 Networks, Inc. BIG-IP Advanced Firewall Manager16.1.0 → 16.1.3fstec_bduRU

showing 20 of 113

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-2104F5 BIG-IP: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2022-11-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2022-12-07modified 2026-06-17

related (4,599)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-96951US	high8.8OT critical	9.81% (96th)	KEV	2026-10-13
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-105134US	critical10.0OT critical	81.8% (100th)	KEV	2026-10-04
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication…
CVE-2026-8037US	critical9.8OT critical	99.8% (100th)	KEV	2026-06-04
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster applian…
CVE-2026-42271US	high8.8OT critical	91.4% (100th)	KEV	2026-05-08
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server befo…
CVE-2026-22719US	—OT critical	18.3% (97th)	KEV	2026-02-25
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote c…

+4594 more

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan