Eclypsium researchers have published details and PoC exploits for two remotely exploitable injection vulnerabilities affecting F5's BIG-IP Next Central Manager.
They are usually deployed by big enterprises - telcos, internet and cloud service providers - but also governments.
BIG-IP Next Central Manager allows users to centrally control their BIG-IP Next instances and services.
CVE-2024-21793 and CVE-2024-26026 - both injection vulnerabilities that may allow attackers to execute malicious SQL statements through the BIG-IP NEXT Central Manager API - have been found by researcher Vladyslav Babkin.
The PoCs Eclypsium shared for the two CVE-numbered flaws may allow attackers attackers to grab admin's password hash.
Eclypsium researchers have also flagged three additional vulnerabilities that ended up not receiving a CVE number.
They may allow attackers to create accounts on the devices, easily obtain the admin password, and to reset the password on accounts without knowing the previous one.
F5 has released fixes for the two injection vulnerabilities and are urging admins to implement them.
They can mitigate them by restricting management access to F5 products to only trusted users and devices over a secure network.
There is currently no indication that these flaws are being exploited by attackers.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Thu, 09 May 2024 14:43:06 +0000