What it is about

BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in F5 BIG-IP und BIG-IP Next ausnutzen, um einen Denial of Service Angriff durchzuführen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• einen Denial of Service Angriff durchzuführen

Am I affected?

Affected according to the BSI:

• F5 BIG-IP Next SPK <1.7.18
• F5 BIG-IP Next SPK >=2.0.0
• F5 BIG-IP Next SPK <=2.0.3
• F5 BIG-IP Next CNF <2.3.2
• F5 BIG-IP Next CNF <2.2.3
• F5 BIG-IP Next CNF <1.4.3
• F5 BIG-IP Next for Kubernetes <2.3.2
• F5 BIG-IP Next for Kubernetes <2.2.3
• F5 BIG-IP <21.1.0.1
• F5 BIG-IP <21.0.0.3
• F5 BIG-IP <17.5.1.8
• F5 BIG-IP <117.1.3.4

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• F5 BIG-IP Next SPK 1.7.18
• F5 BIG-IP Next SPK >=2.0.0
• F5 BIG-IP Next SPK <=2.0.3
• F5 BIG-IP Next CNF 2.3.2
• F5 BIG-IP Next CNF 2.2.3
• F5 BIG-IP Next CNF 1.4.3
• F5 BIG-IP Next for Kubernetes 2.3.2
• F5 BIG-IP Next for Kubernetes 2.2.3
• F5 BIG-IP 21.1.0.1
• F5 BIG-IP 21.0.0.3
• F5 BIG-IP 17.5.1.8
• F5 BIG-IP 117.1.3.4

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.