CISA adds actively exploited critical F5 BIG-IP bug to its must-patch list

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a critical bug in F5's Big-IP software that is being actively exploited. 

The network and application delivery firm on May 4 disclosed a critical authentication bypass affecting the iControl REST component in multiple versions of its Big-IP software. The bug, tagged as CVE-2022-1388, had a CVSSv3 severity score of 9.8 out of 10 in part because of its ease of exploitation. 

Within days of F5's advisory, security researchers saw potential attackers scanning for vulnerable F5 system admin interfaces exposed on the internet.      

SEE: Cloud computing security: New guidance aims to keep your data safe from cyberattacks and breaches

Ron Bowes at security company Rapid 7 expects exploitation attempts to increase because the bug is easy to exploit. Also, exploit code that provides root access to affected devices is publicly available.

However, Bowes reckons there are only about 2,500 F5 BIG-IP devices exposed on the internet based on a shodan.io search.

Affected organizations should patch the critical F5 Big-IP bug swiftly. Palo Alto Networks says that on Wednesday it observed over 2,500 scanning and active exploitation attempts within just 10 hours. 

"We observed this signature triggered 2,552 times between 4:47 and 14:00 UTC on May 10. We were able to analyze 2,151 packets that triggered the signature and observed both vulnerability scanning activity and active exploitation attempts," the security firm's Unit 42 group said.  

CISA notes that F5 BIG-IP contains a missing authentication in critical function vulnerability that can allow for remote code execution, creation or deletion of files, or disabling services.

The F5 bug is the only new addition this month to CISA's Known Exploited Vulnerabilities Catalog. Federal civilian agencies are expected to apply the F5 patch by 31 May under CISA's binding operational directive. However, it recommends organizations beyond the scope of the directive apply the patch too. 

In March, CISA ordered agencies to fix 95 and 66 bugs, many of them older bugs in what appeared to be a massive clean up effort. It added seven bugs in April and five more last week.