CVE-2021-22981
Estado: ModificadaMedia (4.8)—
On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Puntuación base: 4.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.56%
- Percentil entre todas las CVEs puntuadas: 45
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (14)
F5 — Big-ip Access Policy ManagerF5 — Big-ip Advanced Firewall ManagerF5 — Big-ip Advanced WEB Application FirewallF5 — Big-ip AnalyticsF5 — Big-ip Application Acceleration ManagerF5 — Big-ip Application Security ManagerF5 — Big-ip Ddos Hybrid DefenderF5 — Big-ip Domain Name SystemF5 — Big-ip Fraud Protection ServiceF5 — Big-ip Global Traffic ManagerF5 — Big-ip Link ControllerF5 — Big-ip Local Traffic ManagerF5 — Big-ip Policy Enforcement ManagerF5 — Big-ip SSL Orchestrator
CWE
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-22981",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.5,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "f5sirt@f5.com",
"affectedData": [
{
"vendor": "n/a",
"product": "BIG-IP",
"versions": [
{
"status": "affected",
"version": "All versions of 12.1.x and 11.6.x"
}
]
}
]
}
],
"published": "2021-02-12T18:15:12.797",
"references": [
{
"url": "https://support.f5.com/csp/article/K09121542",
"tags": [
"Vendor Advisory"
],
"source": "f5sirt@f5.com"
},
{
"url": "https://support.f5.com/csp/article/K09121542",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."
},
{
"lang": "es",
"value": "En todas las versiones de BIG-IP 12.1.x y 11.6.x, el protocolo TLS original incluye una debilidad en la negociación del secreto maestro que es mitigada por la extensión Extended Master Secret (EMS) definida en RFC 7627. Las conexiones TLS que no utilizan EMS son vulnerables a ataques man-in-the-middle durante la renegociación. Nota: No son evaluadas las versiones de software que han alcanzado End of Software Development (EoSD)"
}
],
"lastModified": "2026-06-17T03:38:08.890",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61D1B91F-8672-4947-AF9A-F635679D0FB7",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "151ED6D1-AA85-4213-8F3A-8167CBEC4721",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8A02AA8-E1CA-487B-AAF3-9AD3206D417E",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "322AA283-E494-45E0-975E-2725E2FCC2DE",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3787453-ECE9-4958-8FD8-8A43A9F86077",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D5AA99B-08E7-4959-A3B4-41AA527B4B22",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05ED802A-A8A0-4E96-AB45-811A98AA11C2",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DC86A5F-C793-4848-901F-04BFB57A07F6",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B15992E6-85B6-4E62-A284-FE4B78F5F373",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E5552A3-91CD-4B97-AD33-4F1FB4C8827A",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70F9B5A0-0EF7-4D2E-B8DF-EA3508BF4B61",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E42E5C6-2E8F-4879-A5A9-3FE8422D0445",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8376922B-0D04-4E5D-BADE-0D6AC23A4696",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55C2EC23-E78F-4447-BACF-21FC36ABF155",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0471086D-B70E-4B87-862E-01FB99B0D5D5",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "945A19E8-51EB-42FE-9BF1-12DAC78B5286",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD3D5803-35A0-4FF7-9AD3-E345C53A18FC",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB5007D0-BBDB-4D74-9C88-98FBA74757D1",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E20DFBD1-5469-4330-81B1-078D6487C01D",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7725810-66D2-4460-A174-9F3BFAD966F2",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F92F2449-8A6E-431E-8CB1-5255D2464B31",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EFD760FE-4347-4D36-B5C6-4009398060F2",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53F940F3-6CF4-48C8-BFBF-4FE9B3A26D31",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65B76F53-7D8B-477E-8B6E-91AC0A9009FF",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B12C324-109D-42BB-82E9-702C946491BB",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.6.1"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "440C631C-1C66-4A26-BE28-D3D1CCC4AD2F",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "f5sirt@f5.com"
}