Rapid7 has some fun research that achieves Remote Code Execution on F5 BIG-IP and BIG-IQ devices. The problem is the iControl SOAP API endpoint, which lacks Cross-Site Request Forgery (CSRF) protections, so it can be called from a script running on a visited webpage (CVE-2022-41622). The attack is to trick an admin into loading such a page, and then let the admin’s own browser send the API requests with their authentication attached. A later post points to F5’s advisory K97843387, which covers it together with a second High severity CVE.
