CVE-2022-29263: Microsoft APM insecure temp files

CISO Take

CVE-2022-29263 is an insecure temporary file handling flaw (CWE-732, incorrect permission assignment) in the BIG-IP Edge Client Component Installer Service, which lets a low-privileged local user tamper with files and escalate to full control of the client host (CVSS 7.8). Exploitation likelihood is low: EPSS is 0.002 (still in the top 90th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. It has no direct AI/ML function, and the 'AI package' tagging (0 downstream dependents, 0/100 package risk) looks like a catalog artifact, so treat it as a conventional endpoint and VPN-client risk. The exposure for AI teams is indirect: if data scientists or ML engineers reach GPU or training environments through the Edge Client on shared or multi-user workstations, a local foothold could become privilege escalation and credential theft. Update BIG-IP APM Clients to 7.2.1.5 or later and the APM server to a fixed release (16.1.2.2, 15.1.5.1, 14.1.4.6 or 13.1.5). Upgrade 12.1.x and 11.6.x, which are end of support and have no fix.

Sources:NVDEPSSf5.com

What is the risk?

Medium-low overall. The CVSS 7.8 rating reflects local access, low complexity, low privileges and no user interaction, with high confidentiality, integrity and availability impact on the client machine. Real-world risk is reduced by the need for prior local code execution, the low EPSS (0.00208), no KEV listing, no public exploit and no scanner template. Risk rises on shared or unmanaged endpoints, and for end-of-support APM versions that will never be patched. No AI/ML-specific attack surface is involved.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged local code execution on a workstation running the BIG-IP Edge Client.

Exploitation

Attacker abuses weak permissions on temporary files used by the installer service to run code with elevated rights.

AML.T0106

Credential Access

With elevated privileges, attacker harvests cached VPN, cloud and API credentials from the host.

Impact

Attacker uses the stolen access to reach AI/ML environments and exfiltrate models or datasets.

Initial Access

Attacker obtains low-privileged local code execution on a workstation running the BIG-IP Edge Client.

Exploitation

Attacker abuses weak permissions on temporary files used by the installer service to run code with elevated rights.

AML.T0106

Credential Access

With elevated privileges, attacker harvests cached VPN, cloud and API credentials from the host.

Impact

Attacker uses the stolen access to reach AI/ML environments and exfiltrate models or datasets.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	pip	—	No patch
4.1KPushed 8d ago63% patched~20d to patchFull package profile →
Microsoft APM	pip	—	No patch
4.1KPushed 8d ago63% patched~20d to patchFull package profile →

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade BIG-IP APM Clients to 7.2.1.5 or later and the APM server to 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 or newer, following F5 advisory K33552735. 2) Move off 12.1.x and 11.6.x, which are end of technical support and not evaluated or fixed. 3) Restrict local user rights on endpoints that run the Edge Client, and limit shared workstation use. 4) Monitor for unexpected file creation or modification in the installer service's temp directories, and for privilege escalation from non-admin sessions. 5) Inventory which AI/ML users and engineers rely on the client and prioritize their endpoints.

How is it classified?

Code ExecutionFrameworkAML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

Frequently Asked Questions

What is CVE-2022-29263?

CVE-2022-29263 is an insecure temporary file handling flaw (CWE-732, incorrect permission assignment) in the BIG-IP Edge Client Component Installer Service, which lets a low-privileged local user tamper with files and escalate to full control of the client host (CVSS 7.8). Exploitation likelihood is low: EPSS is 0.002 (still in the top 90th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. It has no direct AI/ML function, and the 'AI package' tagging (0 downstream dependents, 0/100 package risk) looks like a catalog artifact, so treat it as a conventional endpoint and VPN-client risk. The exposure for AI teams is indirect: if data scientists or ML engineers reach GPU or training environments through the Edge Client on shared or multi-user workstations, a local foothold could become privilege escalation and credential theft. Update BIG-IP APM Clients to 7.2.1.5 or later and the APM server to a fixed release (16.1.2.2, 15.1.5.1, 14.1.4.6 or 13.1.5). Upgrade 12.1.x and 11.6.x, which are end of support and have no fix.

Is CVE-2022-29263 actively exploited?

No confirmed active exploitation of CVE-2022-29263 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-29263?

1) Upgrade BIG-IP APM Clients to 7.2.1.5 or later and the APM server to 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 or newer, following F5 advisory K33552735. 2) Move off 12.1.x and 11.6.x, which are end of technical support and not evaluated or fixed. 3) Restrict local user rights on endpoints that run the Edge Client, and limit shared workstation use. 4) Monitor for unexpected file creation or modification in the installer service's temp directories, and for privilege escalation from non-admin sessions. 5) Inventory which AI/ML users and engineers rely on the client and prioritize their endpoints.

What systems are affected by CVE-2022-29263?

This vulnerability affects the following AI/ML architecture patterns: Remote access to ML development environments, Shared data science workstations, Training pipelines reached via VPN.

What is the CVSS score for CVE-2022-29263?

CVE-2022-29263 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

Remote access to ML development environmentsShared data science workstationsTraining pipelines reached via VPN

MITRE ATLAS Techniques

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Exploitation Scenario

An attacker with a low-privileged foothold on a data scientist's workstation, for example through a malicious package or phishing, finds the Edge Client Component Installer Service writing temporary files with weak permissions. They replace or manipulate those files so the service runs attacker-controlled code with elevated privileges. With SYSTEM-level access they dump cached credentials, VPN tokens and cloud keys, then pivot into the ML training environment or model registry to steal model artifacts or datasets.

Weaknesses (CWE)

CWE-732Incorrect Permission Assignment for Critical Resource

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.