Network security vendor F5 has revealed a critical CVSS 9.8 vulnerability that affects all version of their BIG-IP range from version 11.x through to 16.x
The vulnerability which was discovered by F5’s own testing, could allow an unauthenticated attacker with network access to the BIG-IP system through the management port (or self-ip address) to execute arbitrary system commands, create or delete files or disable services. The flaw is in the REST authentication module of the iControl software (CVE-2022-1388).
F5 has issued a detailed security advisory which points out that this vulnerability only applies to the control plane – not the data plane – so in a properly segmented network an attacker would need to gain access to your management LAN segment in order to exploit this vulnerability. If the management interface is exposed to the main corporate LAN or even the internet, then the risk is significantly increased as this vulnerability can be exploited by an unauthenticated attacker without the need for a password.
Fixes are now available for versions 13.x through 16.x of BIG-IP – although F5 warns in the security advisory that versions 11.x and 12.x will not be fixed.
This vulnerability was disclosed as part of a larger May 2022 security advisory from F5 which details several dozen security vulnerabilities which network admins should review urgently.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)