High Severity Vulnerabilities Reported in F5 BIG-IP and BIG-IQ Devices

Multiple security vulnerabilities have been disclosed in F5 Major-IP and Major-IQ devices that, if productively exploited, to wholly compromise influenced techniques.

Cybersecurity company Speedy7 reported the flaws could be abused to distant obtain to the devices and defeat security constraints.

The two significant-severity issues, which ended up noted to F5 on August 18, 2022, are as follows –

• CVE-2022-41622 (CVSS score: 8.8) – A cross-internet site ask for forgery (CSRF) vulnerability by way of iControl Soap, main to unauthenticated remote code execution.
• CVE-2022-41800 (CVSS rating: 8.7) – An iControl Rest vulnerability that could let an authenticated person with an Administrator purpose to bypass Equipment method limitations.

“By effectively exploiting the worst of the vulnerabilities (CVE-2022-41622), an attacker could get persistent root access to the device’s administration interface (even if the management interface is not internet-experiencing),” Fast7 researcher Ron Bowes reported.

However, it is really really worth noting that this sort of an exploit involves an administrator with an active session to stop by a hostile internet site.

Also identified have been 3 distinct occasions of security bypass, which F5 claimed are unable to be exploited without having to start with breaking current security boundaries by way of a previously undocumented mechanism.

Should really such a state of affairs occur, an adversary with Sophisticated Shell (bash) entry to the equipment could weaponize these weaknesses to execute arbitrary procedure instructions, build or delete information, or disable providers.

When F5 has created no point out of any of the vulnerabilities getting exploited in attacks, it is proposed that people implement the needed patches to mitigate possible hazards.

Discovered this posting exciting? Abide by THN on Facebook, Twitter  and LinkedIn to browse a lot more distinctive content we post.

Some parts of this article are sourced from:
thehackernews.com