Threat Advisory: Critical F5 BIG-IP Vulnerability

Summary: F5 disclosed CVE-2022-1388 on May 4, 2022, an authentication bypass in the iControl REST component of BIG-IP that lets an unauthenticated attacker execute arbitrary system commands, create and delete files, and disable services, and carries a CVSS score of 9.8 out of 10. Proof-of-concept exploit code has circulated on Twitter and GitHub, Cisco's Kenna Risk Score for the flaw rose from 33 to 50 out of 100 in 24 hours, and researchers note it can be used to drop web shells for prolonged backdoor access.
Why it matters: BIG-IP appliances sit at the edge as load balancers and firewalls, and the flaw affects everything under the /mgmt path, so any management interface exposed to the public internet is reachable by an unauthenticated attacker with widely published exploit code.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-1388
Related: CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 10, 2022
Threat Brief: CVE-2022-1388 Cyber Risks ·
Observed in the Wild: F5 BIG-IP CVE-2022-1388 Cyber Risks ·