CVE-2022-33947: F5 BIG-IP Domain Name System

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP Domain Name System: from 13.1.0, up to and including 13.1.5; from 14.1.0, before 14.1.5 (fixed in 14.1.5); from 15.1.0, before 15.1.6.1 (fixed in 15.1.6.1); from 16.1.0, before 16.1.3 (fixed in 16.1.3)

Published 2022-08-04. Last modified 2026-06-17.