Mining The Undiscovered Country With Grey Noise EAP Sensors: F5 BIG-IP Edition
Summary: GreyNoise researcher Ron Bowes built a simple clone of the F5 BIG-IP management port as a honeypot, ran it for a couple of weeks, and analyzed the captured traffic with tshark. The traffic included brute-force logins with credentials like "user123" and "password123", attempts to exploit CVE-2021-22986, requests to the /mgmt/tm/util/bash endpoint tied to auth-bypass issues like CVE-2022-1388, and two exploitation attempts against /mgmt/shared/iapp/rpm-spec-creator related to CVE-2022-41800.
What you should know: A two-week honeypot on a single F5 management port drew brute-force attempts and exploitation traffic for three separate CVEs, and Bowes notes most of it was unrelated to the rumored 0-day - meaning exposed management interfaces are being probed continuously, not just when a new flaw makes headlines.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-22986CVE-2022-1388CVE-2022-41800CVE-2026-123158
- Related
- Grey Noise 2022 Mass Exploitation Report Cyber Risks ·