Observed in the Wild: F5 BIG-IP CVE-2022-1388
Summary: F5 Networks issued advisory K23605346 on 4-May-22 for CVE-2022-1388, an iControl REST flaw allowing an unauthenticated attacker to take control of an affected BIG-IP system, rated 9.8 CRITICAL by NIST's National Vulnerability Database. As of 14-May-22, GreyNoise had observed 173 unique IP addresses attempting to exploit the vulnerability, a lower count than the up to 800 unique IPs seen in the first days of Log4Shell's public proof-of-concept release.
What you should know: GreyNoise's captured traffic shows what follows a successful hit: file reads of /etc/shadow and SSH keys, an f5mku master key grab, a script that pulls sitemap1.jpg and runs it as perl to enroll the box in an IRC botnet, and a user created with admin role and bash shell - so the 173 scanning IPs are the start of the problem, not the end of it.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-44228CVE-2022-1388
- Related
- CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 10, 2022CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021Log4Shell Everywhere Cyber Risks ·