Security News > 2020 > July > Admins Urged to Patch Critical F5 Flaw Under Active Attack

Security experts are urging companies to deploy an urgent patch for a critical vulnerability in F5 Networks' networking devices, which is being actively exploited by attackers to scrape credentials, launch malware and more.

Last week, F5 Networks issued urgent patches for the critical remote code-execution flaw, which has a CVSS score of 10 out of 10.

Not long after the flaw was disclosed, public exploits were made available for it, leading to mass scanning for vulnerable devices by attackers and ultimately active exploits.

The exploit of the flaw is trivial: Mikhail Klyuchnikov with Positive Technologies, who originally discovered the flaw, said that in order to exploit the vulnerability, an unauthenticated attacker would only need to send a specifically crafted HTTP request to the server hosting the Traffic Management User Interface utility for BIG-IP configuration.

As more active exploits are detected in the wild, F5 Networks, the U.S. Cyber Command and Chris Krebs, director at the U.S. Cybersecurity and Infrastructure Security Agency, have all urged administrators to implement the offered fixes as soon as possible.

News URL

https://threatpost.com/patch-critical-f5-flaw-active-attack/157164/