{"vulnerability": "cve-2021-22992", "sightings": [{"uuid": "938bcc0c-05a3-4cb6-914e-cbbd5af99029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "MISP/664fbcbc-b316-436e-8913-dcd23926ca2b", "content": "", "creation_timestamp": "2024-11-14T06:07:58.000000Z"}, {"uuid": "32e4e2c3-340e-4ac1-bc47-e53619b88bd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://gist.github.com/Darkcrai86/9c5365908f4220758149d88783ef4767", "content": "", "creation_timestamp": "2025-09-02T10:30:13.000000Z"}, {"uuid": "a782d7f1-c7ec-4f99-b96c-e12550fa109c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_10/21", "content": "", "creation_timestamp": "2021-03-11T10:08:20.000000Z"}, {"uuid": "26132049-6ae6-4470-aa13-ed381609cfb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=561", "content": "", "creation_timestamp": "2021-03-12T04:00:00.000000Z"}, {"uuid": "dd5fcf74-f03c-4e8e-a74e-bbb95fd505fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "published-proof-of-concept", "source": "https://t.me/cKure/4260", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 F5 #Zeroday:\n\nApplication security company F5 Networks on Wednesday published an\u00a0advisory\u00a0warning of four critical vulnerabilities impacting multiple products that could result in a denial of service (DoS) attack and even unauthenticated remote code execution on target networks. The patches concern a total of seven related flaws (from CVE-2021-22986 through CVE-2021-22992),\u00a0two\u00a0of\u00a0which\u00a0were discovered and reported by Felix Wilhelm of Google Project Zero in December 2020. \n\nhttps://thehackernews.com/2021/03/critical-pre-auth-rce-flaw-found-in-f5.html #0day", "creation_timestamp": "2021-03-11T07:19:05.000000Z"}, {"uuid": "4ba2481a-9d14-49a9-ba9f-1a722e1696f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2881", "content": "Critical 1-day Vulnerabilities in F5 BIG-IP, BIG-IQ\n\n1. CVE-2021-22986:\nTraffic Management Microkernels (TMM) uri_normalize_host infoleak/out-of-bounds write\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2126\n2. CVE-2021-22992:\nASM stack-based buffer overflow in is_hdr_criteria_matches\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2132\n3. CVE-2021-22991:\nTMM uri_normalize_host infoleak/out-of-bounds write\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2126", "creation_timestamp": "2024-05-07T14:26:21.000000Z"}, {"uuid": "42a18449-e841-48fe-a237-b252eabc33ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://t.me/cissp/2494", "content": "Critical Vulnerabilities in F5 BIG-IP, BIG-IQ (1-day)\ud83d\ude01\nCVE-2021-22986:\nTraffic Management Microkernels (TMM) uri_normalize_host infoleak and out-of-bounds write (PoC)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2126\nCVE-2021-22992:\nASM stack-based buffer overflow in is_hdr_criteria_matches (PoC)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2132\n\nRed Team Tactics\n1. Phishing Users to Take a Test\nhttps://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test\n2. Windows Server Core 20H2 - Host Registry Virtual Registry Provider Bypass EoP\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n3. Injecting a dynamic library to Firefox\nhttps://wojciechregula.blog/post/how-to-rob-a-firefox", "creation_timestamp": "2026-09-01T17:01:00.204325Z"}, {"uuid": "8ad34d4a-ca61-419b-9c24-193ec820387e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22992", "type": "seen", "source": "https://t.me/cissp/2494", "content": "Critical Vulnerabilities in F5 BIG-IP, BIG-IQ (1-day)\ud83d\ude01\nCVE-2021-22986:\nTraffic Management Microkernels (TMM) uri_normalize_host infoleak and out-of-bounds write (PoC)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2126\nCVE-2021-22992:\nASM stack-based buffer overflow in is_hdr_criteria_matches (PoC)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2132\n\nRed Team Tactics\n1. Phishing Users to Take a Test\nhttps://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test\n2. Windows Server Core 20H2 - Host Registry Virtual Registry Provider Bypass EoP\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n3. Injecting a dynamic library to Firefox\nhttps://wojciechregula.blog/post/how-to-rob-a-firefox", "creation_timestamp": "2026-09-02T01:04:51.019753Z"}]}