CVE-2022-1388 is a missing authentication vulnerability in F5 BIG-IP. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 May 2022, which means attackers have used it in real attacks. F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
What this vulnerability means in a BIG-IP environment
Missing authentication in a perimeter product is dangerous because it can let an unauthenticated requester reach functions that were meant to be trusted. In F5 BIG-IP, that trust boundary is especially important because the appliance often sits in front of applications, identity flows, and remote access paths, so compromise can affect more than one downstream service.
When a vulnerability exposes administrative or device-level functionality without login, the attacker does not need to steal an account first. The result can be direct control over system behaviour, data handling, or availability, which is why missing authentication issues are typically treated as high-value targets in internet-facing infrastructure.
How organisations assess exposure
Exposure starts with asset inventory: organisations need to know where BIG-IP is deployed, which instances are internet reachable, and whether those systems provide functions that users or applications depend on. Vendor advisories and the CISA Known Exploited Vulnerabilities catalogue are the authoritative places to confirm whether a given deployment is in scope and whether exploitation is already being observed in the wild.
Discovery should also look for indirect exposure. A BIG-IP device may not be the most visible system in the estate, but if it fronts critical services, a compromise can create an access path into otherwise well-protected applications. That is why external reachability, management-plane exposure, and role in the traffic path all matter when judging risk.
Remediation and compensating controls
When a fix is available, remediation should be prioritised quickly because missing authentication vulnerabilities are usually simple to exploit once an attacker finds the exposed function. If patching cannot happen immediately, organisations should reduce exposure by limiting network reachability, tightening management access, and isolating the affected system from the public internet where possible.
Compensating controls are not a substitute for remediation, but they can narrow attack surface while change windows are arranged. Segmentation, access restrictions, and careful review of any vendor guidance can reduce the chance that an exposed management interface becomes a foothold for remote code execution or service disruption.
Detection and post-exploitation review
Because exploitation can lead to file creation or deletion, service disabling, or remote code execution, defenders should review the device for signs of tampering after patching or containment. The most useful focus is on unexpected configuration changes, altered files, unusual management activity, service instability, and any evidence that the appliance was used as a launch point into connected systems.
Post-patch review matters even if the vulnerability is closed, because exploitation may have occurred before remediation. A clean patch state does not prove a clean system state, so teams should validate logs, compare configurations, and look for persistence or secondary access paths that could survive the original flaw.
Risk and Threat Considerations
Internet-facing infrastructure with missing authentication is attractive to attackers because it removes the need for credential theft and shortens the path to impact. In a BIG-IP context, that can turn a single vulnerable device into a gateway for disruption, code execution, or further intrusion into services that rely on it.
Failure mechanism: An exposed function accepts requests without proper authentication, allowing an attacker to invoke privileged actions directly and potentially chain that access into code execution or service disruption.
Impact: The compromise can extend beyond the appliance itself, affecting connected applications, availability, and the trust that downstream systems place in the front-end device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | BIG-IP exposure depends on knowing where devices are deployed. |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Missing authentication directly concerns access enforcement on the appliance. | |
| DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Exploitation review relies on monitoring for unusual traffic and device behaviour. | |
| Recommendation — Inventory BIG-IP devices and flag internet-reachable instances first. Verify access enforcement on BIG-IP management and service paths. Monitor BIG-IP traffic and management activity for abnormal access. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment requires finding affected systems and reachability. |
| AC-3 — Access Enforcement | The vulnerability is a failure of access enforcement on a critical function. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-compromise review depends on reviewing logs and device events. | |
| Recommendation — Scan for exposed BIG-IP assets and validate remediation status. Enforce authentication on sensitive BIG-IP functions and interfaces. Review logs and device events for signs of exploitation or tampering. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | You cannot assess exposure without knowing where BIG-IP is deployed. |
| CIS-7 — Continuous Vulnerability Management | The term requires rapid identification and remediation of the vulnerable platform. | |
| Recommendation — Maintain an accurate inventory of all BIG-IP instances and their exposure. Prioritise remediation and verify closure for exposed BIG-IP systems. | ||
Practitioner Guidance
Why practitioners should care: Treat this class of issue as an exposure problem, not just a patching task. If a BIG-IP instance is internet reachable and supports sensitive functions, the operational priority is to reduce the attacker’s ability to reach the vulnerable path before the remediation window closes.
What to watch for: After mitigation, verify that the device is still functioning normally and that no unexpected changes appeared during the exposure window. If the appliance was reachable during active exploitation, a compromise review should be part of closure, not an optional follow-up.