F5 published security advisory K97843387 for two High severity CVEs, CVE-2022-41622 and CVE-2022-41800. A week earlier Rapid7’s research showed how the missing CSRF protection on the iControl SOAP API gets an admin’s browser to run API requests for the attacker.
