Critical Vulnerabilities in F5 Software, Patch Now

Summary

Several vulnerabilities, including four critical remote code execution flaws, in F5 Networks BIG-IP (all models prior to version 16.0.1.1 and Advanced WAF/ASM prior to 16.0.1.1) and BIG-IQ (prior to version 8.0.0) software were disclosed on March 10, 2021. The most severe of these vulnerabilities could allow a remote threat actor with access to the interface to execute arbitrary commands on vulnerable BIG-IP systems and, depending on the privileges associated with the user, fully compromise the system.

Recommendations

The NJCCIC highly advises organizations to update vulnerable F5 software as soon as possible, after appropriate testing. Additionally, organizations are encouraged to follow the principle of least privilege to limit the impact of a compromised system. Additional details on these vulnerabilities can be found in the F5 Security Advisory and Bleeping Computer article.