BIG-IP RCE Bug Could Allow Device Takeover

F5 Networks is a leading provider of enterprise networking gear, with software and hardware customers like governments, Fortune 500 firms, banks, internet service providers, and largely known consumer brands (Microsoft, Oracle, and Facebook). 

What Happened?

The vulnerability has been assigned the name CVE-2022-1388 and has a CVSS v3 severity rating of 9.8, making it a critical vulnerability. Its exploitation has the potential to result in a complete takeover of the system.

As stated in the security alert published by F5, the weakness may be traced back to the iControl REST component, which allows a malicious actor to submit unreported requests in order to circumvent the iControl REST authentication in BIG-IP.

The CISA (Cybersecurity and Infrastructure Security Agency) has also issued a notice today, citing the seriousness of the vulnerability and the extensive use of BIG-IP devices in mission-critical applications.

F5 has released security advisories on vulnerabilities affecting multiple products, including various versions of BIG-IP. Included in the release is an advisory for CVE-2022-1388, which allows undisclosed requests to bypass the iControl REST authentication in BIG-IP. An attacker could exploit CVE-2022-1388 to take control of an affected system.

CISA encourages users and administrators to review the F5 webpage, Overview of F5

Read More: