{"uuid": "2d817de0-3b88-48e8-8934-c80fff4c8d38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1388", "type": "exploited", "source": "https://t.me/hacking_Attack/52713", "content": "Black Hat Ethical Hacking\nExploits created for critical F5 BIG-IP flaw, install patch immediately\n\nExploits created for critical F5 BIG-IP flaw, install patch immediatelyPost Views: 4 \nPremium Content\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nSecurity researchers are warning F5 BIG-IP admins to immediately install the latest security updates after creating exploits for a recently disclosed critical CVE-2022-1388 remote code execution vulnerability.\nLast week, F5 disclosed a new critical remote code execution in BIG-IP networking devices tracked as CVE-2022-1388. This vulnerability affects the BIG-IP iControl REST authentication component and allows remote threat actors to bypass authentication and execute commands on the device with elevated privileges.\n\nAs F5 BIG-IP devices are commonly used in the enterprise, this vulnerability is a significant risk as it would allow threat actors to exploit the bug to gain initial access to networks and then spread laterally to other devices.\n\nThese types of attacks could be used to steal corporate data or deploy ransomware on all of the network\u2019s devices.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Exploits easily createdThis weekend, cybersecurity researchers from Horizon3 and Positive Technologies were both able to create exploits for the new F5 BIG-IP vulnerability. They warned that all admins should immediately update their devices as soon as possible due to the trivial nature of the exploit.\nThe new F5 RCE vulnerability, CVE-2022-1388, is trivial to exploit. We spent some time chasing unrelated diffs within the newest version, but @jameshorseman2 ultimately got first blood. We'll release a POC next week to give more time for orgs to patch.#f5 #CyberSecurity pic.twitter.com/O1SivUE4vA\n\n\u2014 Horizon3 Attack Team (@Horizon3Attack) May 6, 2022\n\ud83d\udd25 We have reproduced the fresh CVE-2022-1388 in F5's BIG-IP.\n\nSuccessful exploitation could lead to RCE from an unauthenticated user.\n\nPatch ASAP! pic.twitter.com/WjlWtTgSVz\n\n\u2014 PT SWARM (@ptswarm) May 7, 2022\nSee Also: Attackers Use Event Logs to Hide Fileless Malware Zach Hanley, Chief Attack Engineer at Horizon3, told BleepingComputer that it took them only two days to discover the exploit and expect threat actors to begin exploiting devices soon. \n\n\u201cGiven that the mitigations released by F5 for CVE-2022-1388 were a very large hint at where to look when reversing the application, we expect that threat actors may have also discovered the root cause as well,\u201d Hanley told BleepingComputer via email.\n\n\u201cIt took the Horizon3.ai attack team of two security researchers two days to track down the root cause, so we fully expect by end of next week that this will be taken advantage of by threat actors.\u201d\n\nHanley also warned that the impact of this exploit would be significant as it allows threat actors to gain root access to the devices, which hackers will use for initial access to the corporate networks.\n\n\u201cThe saving grace here is that this vulnerability only affects the management side of the device, which should not be exposed to the internet,\u201d continued Hanley.\n\nHowever, Rapid7 researcher Jacob Baines tweeted\u00a0that there are still 2,500 devices exposed to the Internet, making this a substantial risk to the enterprise.\n\nHorizon3 says they will be publicly releasing their proof-of-concept exploit this week to push organizations to patch their devices.\nSee Also: OSINT Tool: MOSINT Install security updates immediately[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T22:00:05.017743Z"}