CVE-2022-26071

Q: What is the severity of CVE-2022-26071?

CVE-2022-26071 has a CVSS score of 7.4 (HIGH). This vulnerability in F5 BIG-IP's Traffic Management Microkernel allows attackers to bypass UDP source port randomization, enabling them to scan open UDP ports on affected systems. This affects multiple BIG-IP versions, particularly those still in supported lifecycle stages. The flaw essentially weakens network security by making port scanning more effective.

7.4 HIGH

📋 TL;DR

This vulnerability in F5 BIG-IP's Traffic Management Microkernel allows attackers to bypass UDP source port randomization, enabling them to scan open UDP ports on affected systems. This affects multiple BIG-IP versions, particularly those still in supported lifecycle stages. The flaw essentially weakens network security by making port scanning more effective.

💻 Affected Systems

Products:

F5 BIG-IP

Versions: 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, all 12.1.x and 11.6.x versions

Operating Systems: F5 TMOS

Default Config Vulnerable: ⚠️ Yes

Notes: End of Technical Support (EoTS) versions are not evaluated but likely affected. Systems with UDP services exposed are most vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could map all open UDP ports on vulnerable systems, potentially identifying services for further exploitation and enabling targeted attacks against exposed UDP services.

🟠

Likely Case

Network reconnaissance where attackers identify vulnerable UDP services for subsequent attacks, potentially leading to service disruption or data exfiltration.

🟢

If Mitigated

Limited impact if proper network segmentation, firewall rules, and intrusion detection systems are in place to monitor and block suspicious scanning activity.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability enables straightforward port scanning techniques without authentication. While no public exploit code is confirmed, the technical details make weaponization likely.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5

Vendor Advisory: https://support.f5.com/csp/article/K41440465

Restart Required: Yes

Instructions:

1. Review the F5 advisory K41440465. 2. Download the appropriate patched version for your BIG-IP installation. 3. Apply the patch following F5's upgrade procedures. 4. Restart the TMM and verify the fix.

🔧 Temporary Workarounds

Restrict UDP Access

all

Implement firewall rules to limit UDP traffic to only necessary ports and sources.

# Example iptables rule to restrict UDP access
# iptables -A INPUT -p udp --dport [PORT] -j DROP

Network Segmentation

all

Isolate BIG-IP systems in network segments with strict access controls.

🧯 If You Can't Patch

Implement strict network access controls to limit UDP traffic to trusted sources only.
Deploy intrusion detection systems to monitor for UDP port scanning activity and alert on anomalies.

🔍 How to Verify

Check if Vulnerable:

Check BIG-IP version using 'tmsh show sys version' and compare against affected versions listed in the advisory.

Check Version:

tmsh show sys version

Verify Fix Applied:

After patching, verify the version is updated and monitor for any unusual UDP scanning activity.

📡 Detection & Monitoring

Log Indicators:

Unusual UDP connection attempts in system logs
High volume of ICMP replies from TMM

Network Indicators:

Rapid UDP port scanning patterns
Abnormal ICMP traffic associated with UDP ports

SIEM Query:

source="bigip_logs" AND (udp_scan OR icmp_reply_anomaly)

📊 Metadata

CVE ID: CVE-2022-26071

CVSS v3 Score: 7.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE: CWE-330

Published: May 5, 2022

Last Updated: November 21, 2024

🔗 References

https://support.f5.com/csp/article/K41440465 Vendor Advisory
https://support.f5.com/csp/article/K41440465 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5