Permissions, Privileges, and Access Controls in BIG-IP - CVE-2022-35735
Published: August 3, 2022
Vulnerability identifier: #VU66081
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-35735
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improperly impose security restrictions in mcpd. An authenticated Resource Administrator or Manager can create or modify existing monitor objects in the Configuration utility and escalate privileges on the system.
Affected software
BIG-IP
How to mitigate CVE-2022-35735
Install updates from vendor's website.
BIG-IP - addressed in versions 14.1.5.1, 15.1.6.1, 16.1.3.1