CVE-2021-22988: F5 BIG-IP Access Policy Manager RCE Flaw

CVE-2021-22988 Overview

CVE-2021-22988 is an authenticated remote command execution vulnerability in the F5 BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility. The flaw exists in undisclosed pages of the management interface and allows authenticated attackers to execute arbitrary system commands on affected BIG-IP appliances. F5 disclosed the issue on March 31, 2021, and it affects a broad range of BIG-IP modules including Local Traffic Manager (LTM), Access Policy Manager (APM), Application Security Manager (ASM), and SSL Orchestrator. Successful exploitation can lead to full compromise of the appliance, including loss of confidentiality, integrity, and availability of traffic management functions.

Critical Impact
An authenticated attacker with low privileges can execute arbitrary commands on the BIG-IP system through the TMUI, leading to full appliance compromise and potential pivoting into protected application traffic.

Affected Products

F5 BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.4
F5 BIG-IP 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3
BIG-IP modules including LTM, APM, ASM, AFM, Advanced WAF, Analytics, AAM, DDoS Hybrid Defender, DNS, FPS, GTM, Link Controller, PEM, and SSL Orchestrator

Discovery Timeline

2021-03-31 - CVE-2021-22988 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22988

Vulnerability Analysis

The vulnerability resides in the TMUI web-based Configuration utility used to administer F5 BIG-IP devices. Undisclosed pages within TMUI fail to properly validate or sanitize input before passing it to underlying system command handlers. An authenticated user with low privileges on the management interface can craft requests that result in arbitrary command execution in the context of the BIG-IP system. Because BIG-IP devices typically sit in front of business-critical applications and terminate TLS, compromise of the appliance can expose decrypted traffic, credentials, and downstream services. The issue is tracked under [CWE-NVD-noinfo] and carries an EPSS percentile of 84.108, indicating elevated exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is insufficient input validation in privileged TMUI endpoints. User-supplied parameters reach command interpreters or shell contexts without adequate sanitization, enabling injection of operating system commands. Authentication is required, but the privilege level needed is low, which expands the realistic threat surface to include any user with TMUI access, including compromised low-tier administrator accounts.

Attack Vector

The attack vector is network-based against the BIG-IP management interface. An attacker first obtains valid TMUI credentials through phishing, credential stuffing, prior compromise, or reuse of default operator accounts. The attacker then issues authenticated HTTP requests to the vulnerable undisclosed TMUI pages, embedding command payloads in parameters that are passed to backend system calls. Successful exploitation yields code execution as the BIG-IP system user, which can be leveraged to install persistence, exfiltrate configuration data, or tamper with traffic policies. Refer to the F5 Security Advisory K70031188 for vendor-confirmed technical details.

Detection Methods for CVE-2021-22988

Indicators of Compromise

Unexpected authenticated HTTP POST or GET requests to TMUI administrative endpoints from non-administrator source addresses
New or modified files in BIG-IP system directories outside of vendor update windows
Unexplained bash, tmsh, or shell process executions spawned from the TMUI web process
New local accounts, SSH keys, or scheduled jobs added to the appliance without change-control records

Detection Strategies

Monitor BIG-IP audit logs (/var/log/audit) and TMUI request logs for anomalous parameter content and request patterns to undisclosed administrative URIs
Alert on TMUI authentication followed by shell or command execution telemetry on the appliance
Compare running configuration and filesystem hashes against a known-good baseline to identify tampering

Monitoring Recommendations

Forward BIG-IP syslog, audit, and TMUI access logs to a centralized SIEM for correlation with identity and network telemetry
Restrict and continuously monitor management plane access using network segmentation and jump hosts
Track failed and successful TMUI logins, especially from non-administrative accounts, and review for credential abuse

How to Mitigate CVE-2021-22988

Immediate Actions Required

Upgrade BIG-IP to a fixed release: 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, or 11.6.5.3 or later as applicable
Restrict TMUI and management interface access to trusted management networks only, never the public internet
Rotate all administrator and operator credentials and review TMUI user accounts for unauthorized additions

Patch Information

F5 has released fixed versions across all supported BIG-IP branches. Customers should consult the F5 Security Advisory K70031188 for the authoritative list of fixed builds, applicable modules, and upgrade guidance. End-of-Software-Development (EoSD) versions are not evaluated and should be migrated to a supported release.

Workarounds

Block TMUI access from untrusted networks using self-IP port lockdown, packet filters, or upstream firewall rules
Permit TMUI access only over a dedicated, out-of-band management network reachable via VPN or jump host
Enforce least privilege for TMUI accounts and remove unused operator and administrator users to reduce the authenticated attack surface

bash

# Example: restrict BIG-IP management access via tmsh
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 192.168.0.0/16 }
tmsh modify net self <self-ip-name> allow-service { tcp:443 }
tmsh save sys config