TI-2022-07183 Aliases CVE-2022-23009 GHSA-3jr5-px2c-8j7c

Incorrect authorization in BIG-IQ Centralized Management

LOW 34CWE-863Published 2022-01-25 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

EPSS 0.01112 66th percentileScored 2026-11-07

Fix Fixed BIG-IQ Centralized Management: 8.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	BIG-IQ Centralized Management	8 to before 8.1.0	8.1.0	Patch available	CNA

BIG-IQ Centralized Management Vendor— Affected 8 to before 8.1.0 Fixed in 8.1.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:big-iq_centralized_management:8.0.0:::::::*	8.0.0	Vulnerable	F5

cpe:2.3:a:f5:big-iq_centralized_management:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·F5

Remediation

Fix · CNA BIG-IQ Centralized Management Fixed in 8.1.0

Timeline

2026-10-02 Threatist record created from CVE-2022-23009
2026-10-03 Alias added: GHSA-3jr5-px2c-8j7c

References

Advisory 1

https://support.f5.com/csp/article/K47592780

TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
TI-2022-20025 iControl SOAP vulnerability CVSS 3.1HIGH 8.8
TI-2014-00189 The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does… KEVCVSS 3.1MEDIUM 5.5
TI-2019-08571 Resource allocation without limits in Linux kernel CVSS 3.1HIGH 7.5
TI-2002-02356 The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side)… CVSS 3.1HIGH 7.5

See all 84 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences