#VU66081 Permissions, Privileges, and Access Controls in BIG-IP - CVE-2022-35735
Published: August 3, 2022
Vulnerability identifier: #VU66081
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-35735
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
BIG-IP
BIG-IP
Software vendor:
F5 Networks
F5 Networks
Description
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improperly impose security restrictions in mcpd. An authenticated Resource Administrator or Manager can create or modify existing monitor objects in the Configuration utility and escalate privileges on the system.
Remediation
Install updates from vendor's website.