{"uuid": "888a1bb7-80ca-4eac-99c9-5a0e75926904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22986", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"wvu \", \"Rich Warren\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a pre-auth SSRF in the F5 iControl REST API's\\n          /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that\\n          can be used to execute root commands on an affected BIG-IP or BIG-IQ\\n          device. This vulnerability is known as CVE-2021-22986.\\n\\n          CVE-2021-22986 affects the following BIG-IP versions:\\n\\n          * 12.1.0 - 12.1.5\\n          * 13.1.0 - 13.1.3\\n          * 14.1.0 - 14.1.3\\n          * 15.1.0 - 15.1.2\\n          * 16.0.0 - 16.0.1\\n\\n          And the following BIG-IQ versions:\\n\\n          * 6.0.0 - 6.1.0\\n          * 7.0.0\\n          * 7.1.0\\n\\n          Tested against BIG-IP Virtual Edition 16.0.1 in VMware Fusion.\", \"disclosure_date\": \"2021-03-10\", \"fullname\": \"exploit/linux/http/f5_icontrol_rest_ssrf_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"F5 iControl REST Unauthenticated SSRF Token Generation RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"account-lockouts\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/f5_icontrol_rest_ssrf_rce\", \"references\": [\"CVE-2021-22986\", \"URL-https://support.f5.com/csp/article/K03009991\", \"URL-https://attackerkb.com/assessments/f6b19d24-b24e-4abd-98cf-2988d7424311\", \"URL-https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:33.607152Z"}