Critical Remote Code Execution in F5 BIG‑IP & BIG‑IQ iControl REST (CVE‑2021‑22986)
What It Is – A remote code execution (RCE) flaw in the iControl REST API of F5 BIG‑IP and BIG‑IQ centralized management appliances. An unauthenticated attacker who can reach the management interface can execute arbitrary system commands, create or delete files, and disable services.
Exploitability – The vulnerability is publicly disclosed, has a CVSS v3.1 base score of 9.8 (Critical), and proof‑of‑concept exploits are available.
Affected Products – F5 BIG‑IP (all versions prior to the 2021‑12‑08 patch) and BIG‑IQ centralized management appliances.
Why It Matters for Trust & Control Assurance
- Control Objective – Secure Management Interface – Demonstrates the need for continuous verification that privileged management interfaces are hardened, authenticated, and monitored.
- Evidence of Due Diligence – Patch status, configuration baselines, and log‑retention become audit‑ready artifacts that prove an organization is actively managing this control.
- Defensible Audit Trail – Continuous monitoring of device configurations and change‑management logs provides the evidence regulators and enterprise buyers expect under frameworks such as NIST CSF 2.0.
Recommended Actions
- Apply the F5‑issued patches (or the temporary mitigation of restricting management‑plane access to trusted IPs).
- Verify that the iControl REST interface is not exposed to the internet; enforce network‑level segmentation.
- Enable and centralize logging of all management‑plane activity; retain logs for at least 90 days.
- Capture patch‑deployment evidence and map it to the “Secure Management Interface” control in your governance framework.
Source: CISA KEV – CVE‑2021‑22986