CVE-2023-22374: iControl SOAP vulnerability

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 72.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-01 · updated 2026-06-17
Weakness: CWE-134

Description

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 BIG-IP APM: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
BIG-IP: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 Big-Ip Analytics: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 Networks, Inc. BIG-IP (AAM): from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
BIG-IP ASM: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.0, 17.0.0
F5 Big-Ip Ddos Hybrid Defender: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5
F5 BIG-IP DNS: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 17.0.0
F5 Big-Ip Fraud Protection Service: from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 Big-Ip Link Controller: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 BIG-IP (LTM): from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 Networks, Inc. BIG-IP (PEM): from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0
F5 Big-Ip Ssl Orchestrator: from 14.1.4.6 through 14.1.5; from 15.1.5.1 through 15.1.8; from 16.1.2.2 through 16.1.3; 13.1.5, 17.0.0

References

Get alerted when CVE-2023-22374 or the next vulnerability affects your stack