CVE-2021-22990: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2021-22990 is an authenticated remote command execution vulnerability affecting BIG-IP systems with Advanced WAF or BIG-IP ASM provisioned. The vulnerability exists in undisclosed pages of the Traffic Management User Interface (TMUI), also referred to as the Configuration utility. The affected versions include BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3. Software versions which have reached End of Software Development (EoSD) were not evaluated (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a Base Score of 9.0 (HIGH) with the vector (AV:N/AC:L/Au:S/C:C/I:C/A:C) (NVD).

If successfully exploited, the vulnerability could allow an authenticated attacker to execute arbitrary commands on the affected system, potentially leading to complete system compromise (Threatpost).

F5 has released patched versions to address this vulnerability. Organizations should update their BIG-IP systems to the following versions: 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, or 11.6.5.3, depending on their current version (NVD).