QID 375752

F5 BIG-IP ASM (Application Security Manager) is a flexible web application firewall that secures web applications in traditional, virtual, and private cloud environments.

A malicious HTTP response to an Advanced WAF/ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. (CVE-2021-22992)

Vulnerable Component: BIG-IP ASM

Affected Versions:
16.0.0 - 16.0.1.0
15.1.0 - 15.1.2.0
14.1.0 - 14.1.3
13.1.0 - 13.1.3.5
12.1.0 - 12.1.5.2
11.6.1 - 11.6.5.2

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

On successful exploitation of the vulnerability an attacker may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise