CVE-2023-22374

What it actually does

CVE-2023-22374 is a format string memory-corruption vulnerability in F5 BIG-IP iControl SOAP. An authenticated network attacker with low privileges can send crafted SOAP input that is interpreted as a format string by the iControl SOAP CGI process. Successful exploitation can crash the CGI process, causing denial of service for management functions, and may allow arbitrary code execution in the context of the affected management component. Because the vulnerability has scope change in appliance mode, exploitation can cross a security boundary and compromise isolation assumptions on the BIG-IP appliance.

Why it matters to the business

Compromise of BIG-IP management services can have outsized operational impact because these devices often sit in front of critical applications and control traffic routing, SSL/TLS handling, access policy, DNS, web application firewall, and DDoS protections. An attacker who exploits this after obtaining credentials could disrupt administration, alter traffic-handling behavior, access sensitive configuration or secrets, and potentially use the device as a foothold into protected networks. The EPSS score is high, indicating elevated likelihood of exploitation attempts even though it is not currently listed in CISA KEV and no ransomware use is identified in the provided data.

How an attack unfolds

An attacker first needs authenticated access to the BIG-IP management plane or iControl SOAP interface, typically through stolen credentials, reused passwords, exposed management services, or a compromised administrator account. The attacker then sends a crafted SOAP request to the iControl SOAP CGI endpoint containing format-string specifiers in a vulnerable field. When the CGI process handles the request, attacker-controlled data is processed as a format string rather than plain input. At minimum, this can crash the iControl SOAP CGI process and disrupt management functionality. With a reliable exploit, the attacker may be able to influence memory reads or writes and execute code under the privileges of the affected process. In appliance mode, successful exploitation can break the intended security boundary, increasing the impact beyond a simple management-process crash. Post-exploitation objectives may include harvesting configuration data, modifying device settings, creating persistence, pivoting through trusted network paths, or interfering with application delivery services.

How to fix it

Upgrade affected BIG-IP software to a vendor-supported release that includes F5's fix for CVE-2023-22374. Because exact fixed versions were not provided in the input, validate the appropriate target version against the official F5 security advisory for each deployed BIG-IP module and branch. Systems on End of Technical Support releases should be upgraded or replaced with supported versions because they may not be evaluated or patched. As compensating controls, restrict BIG-IP management and iControl SOAP access to dedicated administrative networks, VPNs, or bastion hosts; block internet access to management interfaces; enforce least-privilege administrative accounts; require strong authentication for management access; remove unused accounts; monitor and limit SOAP API usage; and ensure appliance-mode deployments are treated as high priority due to the security-boundary impact.

How to confirm the fix worked

Confirm each BIG-IP device version and hotfix level using vendor-supported inventory methods such as the BIG-IP Configuration utility or command-line version output, then compare against the F5 advisory for this vulnerability. Verify that iControl SOAP and management interfaces are not reachable from untrusted networks by testing access to the management plane and the iControl SOAP endpoint from external and non-administrative segments. Confirm that only approved administrators can authenticate and that low-privilege accounts cannot access unnecessary iControl SOAP functions. Review recent configuration backups and device state after patching to ensure no unauthorized users, iRules, traffic policies, SSL profiles, or management settings were added before remediation.

Typical attack path

1. Identify an exposed BIG-IP management or iControl SOAP service.
2. Obtain valid BIG-IP credentials through phishing, credential reuse, password spraying, credential theft, or prior compromise.
3. Authenticate to the iControl SOAP interface.
4. Send a crafted SOAP request to the iControl SOAP CGI endpoint containing malicious format-string input.
5. Trigger a crash of the iControl SOAP CGI process or attempt memory corruption for code execution.
6. If code execution succeeds, access BIG-IP configuration, secrets, and administrative functions.
7. Modify traffic, security, or access policies; create persistence; or pivot deeper into connected networks.

How to detect it

Investigate historical BIG-IP management-plane activity for signs of authenticated iControl SOAP abuse. Relevant sources include BIG-IP audit logs, authentication logs, local traffic/system logs, HTTP daemon logs, management access logs, core-dump locations, and centralized SIEM records that collect management-plane events. Look for successful or failed logins followed by POST requests to the iControl SOAP CGI endpoint, especially requests containing format-string tokens such as %n, %x, %p, or repeated percent-format sequences in SOAP parameters. Correlate these events with crashes, segmentation faults, restarted CGI/httpd processes, generated core files, unexpected configuration changes, new accounts, altered authentication settings, modified iRules, changed traffic policies, or unexplained device failovers. Because exploitation requires authentication, give special attention to low-privilege accounts performing unusual SOAP API activity, logins from new source IPs, impossible-travel patterns, off-hours access, or management access from non-administrative networks. Absence of a public KEV listing does not eliminate risk; the high EPSS value justifies retrospective hunting where management access was exposed or credentials may have been compromised.

• POST /iControl/iControlPortal.cgi
• /iControl/iControlPortal.cgi
• SOAPAction:
• iControlPortal.cgi
• %n
• %x
• %p
• %s
• segfault
• Segmentation fault
• core dumped
• iControl SOAP
• /var/core
• /var/log/audit
• /var/log/ltm
• /var/log/httpd/httpd_errors
• /var/log/secure

What your security team should do

• Prioritize remediation for internet-exposed or broadly reachable BIG-IP management interfaces, especially where appliance mode is used.
• Upgrade all affected supported BIG-IP releases to the F5-fixed versions identified in the official advisory; migrate EoTS systems to supported releases.
• Immediately restrict management and iControl SOAP access to trusted administrative networks or VPN-only paths.
• Audit BIG-IP local and remote-authentication accounts for unnecessary privileges, stale accounts, and recent suspicious logins.
• Review logs for iControl SOAP access, CGI crashes, segmentation faults, core dumps, and unexpected management-plane activity before and after patching.
• Rotate credentials for BIG-IP administrators if suspicious authentication or SOAP activity is found.
• Validate that configuration objects, iRules, traffic policies, device trust settings, and management users have not been modified unexpectedly.
• Add SIEM detections for SOAP requests containing format-string patterns and for crashes of the iControl SOAP CGI process.