CVE-2019-6641: On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash.

Security readout for executives and security teams

This issue affects F5 BIG-IP 12.1.0 through 12.1.4.1. An authenticated user, even with any role, can send undisclosed requests that crash iControl REST processes. The sources do not indicate data theft, remote code execution, unauthenticated access, or confirmed active exploitation. Exposure is limited to organizations running affected BIG-IP versions where users can authenticate to iControl REST. Risk increases when management interfaces are broadly reachable or many low-privilege users have accounts. Handle as a management-plane availability risk. It is not described as unauthenticated or code execution, but authenticated users could disrupt BIG-IP administration or automation if affected systems remain exposed. Mitigation focus: Check F5 advisory K22384173 for supported fixes or vendor workarounds.; Restrict iControl REST access to trusted management networks and authorized users.; Review and remove unnecessary BIG-IP user accounts and roles..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.