F5 BIG-IP iControl REST CVE-2022-1388 (authentication bypass to root command execution, CVSS 9.8, CISA KEV, AA22-138A): which versions are fixed and how do I lock down the management plane?

What it is: CVE-2022-1388 is a missing-authentication flaw in the iControl REST API of F5 BIG-IP. An unauthenticated attacker who can reach the management interface or a self IP address with iControl REST exposed can run system commands as root. F5 patched it on May 4, 2022; working exploits appeared within days, CISA and MS-ISAC issued advisory AA22-138A, and it's in the KEV catalog. Old BIG-IP appliances with exposed management interfaces are still found and compromised. Am I affected: - BIG-IP 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, and all 12.1.x and 11.6.x (end of life, no patch). - Exposure matters: the management interface or self IPs with iControl REST reachable from untrusted networks (or the internet). - Check with tmsh show sys version, and review which self IPs allow management ports (Port Lockdown settings). Fix: 1. Upgrade to a fixed and, today, currently supported BIG-IP release; 11.6.x and 12.1.x must be replaced, not patched. 2. Until upgraded, apply F5's temporary mitigations from K23605346: block iControl REST access through self IPs (set Port Lockdown to Allow None, or restrict it), restrict the management interface to a dedicated, trusted management network, and apply F5's httpd configuration change. 3. Never expose the BIG-IP management interface (or self IPs with management services) to the internet; require MFA for admin access where possible. 4. If the device was exposed and unpatched, assume compromise as CISA advises: hunt using F5's indicators and CISA's detection signatures (POST requests to /mgmt/tm/util/bash), follow F5's compromise guidance (K11438344), rebuild if needed, and rotate admin credentials, keys and certificates stored on the device. Verify: tmsh show sys version reports a fixed, supported release, and from outside your management network the management interface and iControl REST are unreachable. Sources: https://my.f5.com/manage/s/article/K23605346 https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a https://nvd.nist.gov/vuln/detail/CVE-2022-1388