# N/A
## 漏洞概述
BIG-IP和BIG-IQ的某些版本中的iControl REST接口存在未授权的远程命令执行漏洞。
## 影响版本
- BIG-IP 16.0.x 低于 16.0.1.1
- BIG-IP 15.1.x 低于 15.1.2.1
- BIG-IP 14.1.x 低于 14.1.4
- BIG-IP 13.1.x 低于 13.1.3.6
- BIG-IP 12.1.x 低于 12.1.5.3
- BIG-IQ 7.1.0.x 低于 7.1.0.3
- BIG-IQ 7.0.0.x 低于 7.0.0.2
## 漏洞细节
iControl REST接口存在一个未授权的远程命令执行漏洞，攻击者可以利用此漏洞在未授权的情况下执行远程命令。
## 影响
攻击者可能利用该漏洞在未授权的情况下执行远程命令，从而对系统造成严重威胁。已到达软件开发末期（End of Software Development, EoSD）的版本未进行评估。| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | This is a Poc for BIGIP iControl unauth RCE | https://github.com/dorkerdevil/CVE-2021-22986-Poc | POC详情 |
| 2 | cve-2021-22986 f5 rce 漏洞批量检测 poc | https://github.com/S1xHcL/f5_rce_poc | POC详情 |
| 3 | A vulnerability scanner that detects CVE-2021-22986 vulnerabilities. | https://github.com/Osyanina/westone-CVE-2021-22986-scanner | POC详情 |
| 4 | F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE | https://github.com/Udyz/CVE-2021-22986-SSRF2RCE | POC详情 |
| 5 | CVE-2021-22986 F5 BIG-IP iControl 命令执行漏洞 | https://github.com/safesword/F5_RCE | POC详情 |
| 6 | CVE-2021-22986 & F5 BIG-IP RCE | https://github.com/Al1ex/CVE-2021-22986 | POC详情 |
| 7 | None | https://github.com/kiri-48/CVE-2021-22986 | POC详情 |
| 8 | CVE-2021-22986 Checker Script in Python3 | https://github.com/ZephrFish/CVE-2021-22986_Check | POC详情 |
| 9 | F5 BIG-IP远程代码执行；cve-2021-22986，批量检测；命令执行利用 | https://github.com/yaunsky/CVE-202122986-EXP | POC详情 |
| 10 | Code By:Tas9er / F5 BIG-IP 远程命令执行漏洞 | https://github.com/Tas9er/CVE-2021-22986 | POC详情 |
| 11 | None | https://github.com/dotslashed/CVE-2021-22986 | POC详情 |
| 12 | BIGIP F5 | https://github.com/DDestinys/CVE-2021-22986 | POC详情 |
| 13 | None | https://github.com/amitlttwo/CVE-2021-22986 | POC详情 |
| 14 | Custom POC of CVE-2021-22986 by Al1ex@Heptagram | https://github.com/huydung26/CVE-2021-22986 | POC详情 |
| 15 | F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE | https://github.com/microvorld/CVE-2021-22986 | POC详情 |
| 16 | F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3; and BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22986.yaml | POC详情 |
| 17 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/F5%20BIG-IP%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2021-22986.md | POC详情 |