.webp)
UPDATE: CISA has added this vulnerability (CVE-2023-46747) to their known exploited vulnerabilities list as of 11/2/2023. The vendor has also updated their security bulletin under the "Indicators of compromise" section as they have observed threat actors using this vulnerability in conjunction with CVE-2023-46748 to perform an exploit. Patch now!
A critical vulnerability in the F5 BIG-IP Configuration Utility, identified as CVE-2023-46747, has been patched. Reported to have a CVSS score of 9.8, the vulnerability allows an attacker with network access to access the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.
This vulnerability allows an unauthenticated attacker with network access to execute arbitrary system commands through undisclosed requests by bypassing the Configuration utility authentication. The issue is classified as an Authentication Bypass Using an Alternate Path of Channel.
Affected BIG-IP software:
Due to the nature of this vulnerability, its severity, and the available mitigation script from the vendor, the possibility of this vulnerability being exploited is considerable. It allows access to execute arbitrary code on key network configuration software which could be devastating if exploited. The longer this vulnerability is left unpatched, the higher the chance it will be taken advantage of by threat actors.
Currently, patches exist for all vulnerable versions of BIG-IP. See below:
There is also a mitigation script available at the security advisory for this vulnerability. It can only be used on BIG-IP versions 14.1.0 and later or else the configuration utility will not start. If your organization uses the FIPS 140-2 Compliant Mode license you are advised not to use this mitigation as it will cause an integrity check to fail.
There are also two other mitigations: You can block configuration utility access through self IP addresses as well as block configuration utility access through the management interface. Details on how to do so are in the advisory.
Exploitation of this vulnerability can cause financial loss, reputational loss, and data loss. There will be costs associated with incident response, obtaining new hardware/software, PR, productivity loss, and training. An attacker may misconfigure, disallow access to the network, infect devices on the network with malware, etc. Based on the attacker’s objective and expertise and an organization’s response the impact of this could be very high or low.
Patch – We recommend reviewing your network to see if your organization uses F5 network services. If you do, identify if your organization uses the BIG-IP configuration tool and patch accordingly.
Mitigate – If you are unable to patch there are several mitigations which can be put in place located in their security advisory.
https://my.f5.com/manage/s/article/K000137353
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
