CVE-2022-35245— BIG-IP APM access policy vulnerability CVE-2022-35245
Quick assessment
Affected
F5 BIG-IP APM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。 F5 BIG-IP APM 16.1.0至16.1.3版本、15.1.0至15.1.6版本和14.1.0至14.1.5版本存在代码问题漏洞，该漏洞源于在虚拟服务器上配置 BIG-IP APM 访问策略时，未公开的流量可能会导致流量管理微内核(TMM)终止。
Possible ATT&CK Techniques 2 AI
T1499.004 · Application or System Exploitation T1529 · System Shutdown/Reboot
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-35245
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BIG-IP APM access policy vulnerability CVE-2022-35245
Source: CVE Program / CVE List V5
Vulnerability Description
In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
F5 BIG-IP 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。 F5 BIG-IP APM 16.1.0至16.1.3版本、15.1.0至15.1.6版本和14.1.0至14.1.5版本存在代码问题漏洞，该漏洞源于在虚拟服务器上配置 BIG-IP APM 访问策略时，未公开的流量可能会导致流量管理微内核(TMM)终止。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| F5 | BIG-IP APM | 13.1.0 ~ 13.1.x* | - |
|
II. Public POCs for CVE-2022-35245
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-35245
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-35245 (1)
-
https://support.f5.com/csp/article/K58235223 x_refsource_MISC
Same Patch Batch · F5 · 2022-08-04 · 21 CVEs total
| CVE-2022-35243 | 8.7 HIGH | Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243 |
| CVE-2022-35728 | 8.1 HIGH | iControl REST vulnerability CVE-2022-35728 |
| CVE-2022-35272 | 7.5 HIGH | BIG-IP HTTP MRF vulnerability CVE-2022-35272 |
| CVE-2022-35240 | 7.5 HIGH | BIG-IP Message Routing MQTT vulnerability CVE-2022-35240 |
| CVE-2022-35236 | 7.5 HIGH | HTTP2 profile vulnerability CVE-2022-35236 |
| CVE-2022-34862 | 7.5 HIGH | TMM vulnerability CVE-2022-34862 |
| CVE-2022-32455 | 7.5 HIGH | TMM vulnerability CVE-2022-32455 |
| CVE-2022-33203 | 7.5 HIGH | BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203 |
| CVE-2022-34655 | 7.5 HIGH | TMM vulnerability CVE-2022-34655 |
| CVE-2022-34651 | 7.5 HIGH | BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651 |
| CVE-2022-35735 | 7.2 HIGH | BIG-IP monitor configuration vulnerability CVE-2022-35735 |
| CVE-2022-31473 | 6.8 MEDIUM | BIG-IP APM Appliance mode vulnerability CVE-2022-31473 |
| CVE-2022-33962 | 6.7 MEDIUM | BIG-IP iRule vulnerability CVE-2022-33962 |
| CVE-2022-30535 | 6.5 MEDIUM | NGINX Ingress Controller vulnerability CVE-2022-30535 |
| CVE-2022-35241 | 6.5 MEDIUM | NGINX Instance Manager vulnerability CVE-2022-35241 |
| CVE-2022-34844 | 5.9 MEDIUM | BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844 |
| CVE-2022-33947 | 5.4 MEDIUM | BIG-IP DNS TMUI Vulnerability CVE-2022-33947 |
| CVE-2022-34865 | 4.8 MEDIUM | Traffic intelligence feeds vulnerability CVE-2022-34865 |
| CVE-2022-34851 | 4.3 MEDIUM | BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851 |
| CVE-2022-33968 | 3.7 LOW | BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968 |
IV. Related Vulnerabilities
Same vendor: F5
-
CVE-2026-60005
NGINX ngx_http_slice_module vulnerability -
CVE-2026-56434
NGINX ngx_http_ssi_module vulnerability -
CVE-2026-60065
NGINX Plus ngx_stream_mqtt_filter_module vulnerability -
CVE-2026-42533
NGINX Map directive and Regex matching vulnerability -
CVE-2026-52865
NGINX Ingress Controller vulnerability
Same weakness: CWE-476
-
CVE-2026-78148
ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_comput -
CVE-2026-76905
kin-openapi openai3filter: nil-pointer panic in ConvertError -
CVE-2026-17251
Unauthenticated Denial of Service via Null Pointer Dereferen -
CVE-2026-48754
Incus: Nil-pointer dereference in createDependentVolumesFrom -
CVE-2026-47753
Incus has a Nil-Pointer Dereference Panic via Instance Backu
V. Comments for CVE-2022-35245
No comments yet