1. Home
  2. CVE Database
  3. CVE-2022-26340
MEDIUM · 4.9

CVE-2022-26340

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG...

Vulnerability Description

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
F5Big-Ip Access Policy Manager11.6.1
F5Big-Ip Advanced Firewall Manager11.6.1
F5Big-Ip Analytics11.6.1
F5Big-Ip Application Acceleration Manager11.6.1
F5Big-Ip Application Security Manager11.6.1
F5Big-Ip Domain Name System11.6.1
F5Big-Ip Fraud Protection Service11.6.1
F5Big-Ip Global Traffic Manager11.6.1
F5Big-Ip Link Controller11.6.1
F5Big-Ip Local Traffic Manager11.6.1
F5Big-Ip Policy Enforcement Manager11.6.1
F5Big-Iq Centralized Management>= 7.0.0, <= 7.1.0

Related Weaknesses (CWE)

CWE-732

References

FAQ

What is CVE-2022-26340?

CVE-2022-26340 is a vulnerability with a CVSS score of 4.9 (MEDIUM). On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG...

How severe is CVE-2022-26340?

CVE-2022-26340 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-26340?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager.