CISA Confirms Vulnerability in F5 Networks’ BIG-IP Software

The Department of Homeland Security's cybersecurity arm has confirmed that malicious actors had been exploiting a critical vulnerability in software used by the government and the private sector. 

DHS' Cybersecurity and Infrastructure Agency said F5 Networks, the software's developer, released a patch for the weakness on June 30, CyberScoop reported. 

"Unpatched F5 BIG-IP devices are an attractive target for malicious actors. Affected organizations that have not applied the patch to fix this critical remote code execution vulnerability risk an attacker exploiting CVE-2020-5902 to take control of their system," CISA said.

BIG-IP is a family of F5 Networks products covering software and hardware designed around application availability, access control, and security solutions.

According to CISA, open-source reports showed that a proof-of-concept code was available and that threat actors were leveraging the vulnerability to attempt to steal credentials. Threat actors were reportedly also able to exfiltrate data or execute commands on affected devices.  

F5 Networks warned that any remaining devices that have not been patched for CVE-2020-5902 are likely to have been compromised.

CISA said it released its advisory to help victim enterprises recover from the resulting attacks and to encourage them to adopt additional detection measures and mitigations. 

The agency added that it has confirmed two compromises and that it is continuing to work with several entities across multiple sectors to investigate potential compromises related to the exploit. 

CISA urged organizations to urgently their BIG-IP software to the corresponding patches and to reconstitute affected systems if the attacks continue. 

In the event of a compromise, information technology security personnel should also reimage compromised hosts, provision new account credentials, limit access to the management interface to the fullest extent possible and implement network segmentation, CISA said.