Critical patches released for significant F5 BIG-IP vulnerabilities
Soon after the release of patches for critical F5 BIG-IP vulnerability, Security researchers have introduced a POC of exploiting the vulnerability targeting users of BIG-IP devices, namely, governments, Fortune 500 firms, banks, Internet services providers, and brands, such as Microsoft, Oracle, and Facebook, indicating just how easy it is to infiltrate network security systems.
- The 10/10 CVSSv3 rating vulnerability allows a remote attacker to gain full access to the system through Traffic Management User Interface (TMUI), export user credentials and potentially penetrate the device’s network, without the need for authentication.
- In light of the severity of the vulnerability, users were advised by the US Cyber Command to install the security updates as soon as possible.
- Over the last few days, security researchers published a number of PoC exploits to vulnerable F5 BIG-IP devices, to demonstrate the easiness of breaching a network using vulnerable devices.
- It is highly recommended that all BIG-IP devices susceptible to these attacks, such as cloud marketplaces, update to the patched versions available by F5.
TrustNet notified its F5 & TSOC customers and helped them assess their exposure level. Mitigation countermeasures, as well as compensation controls, were suggested based on each customer’s level of impact. If You need help determining your exposure factor, please feel free to contact TSOC.
Stay Safe with TrustNet!
