What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

F5 BIG-IP RCE Vulnerability - CVE-2020-5902

July 6, 2020 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT:

Proof-of-Concept (PoC) code was publicly released on July 5th for a vulnerability affecting F5 BIG-IP (CVE-2020-5902). The vulnerability was publicly disclosed by F5 last week but has become more critical due to recent public exploitation. If exploited, CVE-2020-5902 allows for Remote Code Execution (RCE) at the admin level. This level of access could be used to deploy malware or perform a wide variety of other malicious actions. Organizations making use of F5 BIG-IP are highly recommended to apply the official security patches as soon as possible.

What we’re doing about it

What you should do about it

Additional information

The vulnerability resides in an undisclosed page in the Traffic Management User Interface (TMUI), also known as the Configuration Utility. Attacks in the wild have reportedly exploited the vulnerability to deploy cryptocurrency miners [1]. A major concern is that threat actor groups will exploit this vulnerability to distribute threats with a higher impact, such as ransomware.

The BIG-IP Traffic Management User Interface should not be exposed to the internet. Properly configuring the application will minimize the likelihood of a successful attack. Publicly exposed versions of BIG-IP are still common; searches via the IoT search engine Shodan, show that over 8,000 instances are exposed at the time of writing.

Vulnerable versions of BIG-IP

References:

[1] https://twitter.com/buffaloverflow/status/1279384540847489024

[2] https://support.f5.com/csp/article/K52145254#all

[3] https://support.f5.com/csp/article/K52145254#self

[4] https://support.f5.com/csp/article/K52145254#mgmt

View Most Recent Advisories