QID 376080

An untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows can allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability because the victim must run this utility on the Windows system.CVE-2021-22980

Vulnerable Component: BIG-IP APM

Affected Versions:
16.0.0 - 16.0.1
15.1.0 - 15.1.3
14.1.0 - 14.1.3
13.1.0 - 13.1.3
12.1.0 - 12.1.5
11.6.1 - 11.6.5

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

For some diagnostic functions, you must run the CTU as a privileged user. The CTU prompts the user to escalate privileges for those functions. This vulnerability can allow attackers to trick a victim into loading an arbitrary DLL as a privileged user on the vulnerable Windows system.