Security News > 2020 > July > Make sure you've patched your F5 BIG-IP gear. Exploit code for scary bug pair is so trivial, it fits in a tweet

Exploit code for a nasty vulnerability in F5 Networks' BIG-IP application delivery controllers is now doing the rounds, so make sure you're all patched up.

Now exploit code is being merged into the Metasploit framework for anyone to use, and proof-of-concept code to extract files or execute arbitrary commands, which neatly fits into a tweet, is being shared all over the web.... F5 Big-IP CVE-2020-5902 LFI and RCE. LFI https:///tmui/login.

"The Traffic Management User Interface, also referred to as the Configuration utility, has a Remote Code Execution Vulnerability in undisclosed pages," a spokesperson for F5 told The Reg.

Bug hunter 0xSha has unearthed an annoying hole in a software development kit used by BitDefender and other security suites to provide VPN functionality.

Dubbed ZombieVPN, the vuln appears to be a privilege-escalation flaw in that malicious code running on a Windows PC with the AnchorFree SDK installed can exploit the bug to gain SYSTEM-level control.

News URL

https://go.theregister.com/feed/www.theregister.com/2020/07/06/roundup_week_july2/