Security News > 2022 > May > Critical F5 BIG-IP vulnerability exploited to wipe devices

A recently disclosed F5 BIG-IP vulnerability has been used in destructive attacks, attempting to erase a device's file system and make the server unusable.

Last week, F5 disclosed a vulnerability tracked as CVE-2022-1388 that allows remote attackers to execute commands on BIG-IP network devices as 'root' without authentication.

While most attacks have been used to drop webshells for initial access to networks, steal SSH keys, and enumerate system information, SANS Internet Storm Center saw two attacks that targeted BIG-IP devices in a much more nefarious manner.

SANS told BleepingComputer that their honeypots saw two attacks coming from IP address 177.54.127[.]111 that executes the 'rm -rf /*' command on the targeted BIG-IP device.

"We have been in contact with SANS and are investigating the issue. If customers have not already done so, we urge them to update to a fixed version of BIG-IP or implement one of the mitigations detailed in the security advisory. We strongly advise customers never to expose their BIG-IP management interface to the public internet and to ensure the appropriate controls are in place to limit access." - F5. However, it is important to note that Beaumont found that attacks are also affecting devices on non-management ports if they are misconfigured.

For F5 BIG-IP admins concerned their devices were already compromised, Sandfly Security founder Craig Rowland is offering test licenses that they can use to check their devices.

News URL

https://www.bleepingcomputer.com/news/security/critical-f5-big-ip-vulnerability-exploited-to-wipe-devices/