Security News > 2021 > March > Critical F5 BIG-IP Bug Under Active Attacks After PoC Exploit Posted Online

Almost 10 days after application security company F5 Networks released patches for critical vulnerabilities in its BIG-IP and BIG-IQ products, adversaries have begun opportunistically mass scanning and targeting exposed and unpatched networking devices to break into enterprise networks.

News of in the wild exploitation comes on the heels of a proof-of-concept exploit code that surfaced online earlier this week by reverse-engineering the Java software patch in BIG-IP. The mass scans are said to have spiked since March 18.

The flaws affect BIG-IP versions 11.6 or 12.x and newer, with a critical remote code execution also impacting BIG-IQ versions 6.x and 7.x. CVE-2021-22986 is notable for the fact that it's an unauthenticated, remote command execution vulnerability affecting the iControl REST interface, allowing an attacker to execute arbitrary system commands, create or delete files, and disable services without the need for any authentication.

While F5 said it wasn't aware of any public exploitation of these issues on March 10, researchers from NCC Group said they have now found evidence of "Full chain exploitation of F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986" in the wake of multiple exploitation attempts against its honeypot infrastructure.

Given the popularity of BIG-IP/BIG-IQ in corporate and government networks, it should come as no surprise that this is the second time in a year F5 appliances have become a lucrative target for exploitation.

"The bottom line is that [the flaws] affect all BIG-IP and BIG-IQ customers and instances - we urge all customers to update their BIG-IP and BIG-IQ deployments to the fixed versions as soon as possible," F5 Senior Vice President Kara Sprague noted last week.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/hdV2DXTqVo0/latest-f5-big-ip-bug-under-active.html