The risk of hackers attacking the system from a vulnerability in the F5 BIG-IP product

On May 5, the Department of Information Security sent a warning about the security vulnerability CVE-2022-1388 in the F5 BIG-IP product to the specialized IT units of ministries, branches and localities; corporations, state corporations, banks, financial institutions and a system of specialized information security units.

The agency said that on May 4, network and cloud security solutions provider F5 announced a vulnerability with code CVE-2022-1388 in its BIG-IP iControl REST product. . Rated as critical, this vulnerability allows unauthenticated attackers to execute arbitrary commands, create or delete files, disable services, hijack control system control.

Preliminary assessment by the National Cyber ​​Security Monitoring Center (NCSC) under the Information Security Administration shows that Vietnam currently has hundreds of information systems using F5 BIG-IP products to protect for important web-based systems such as public services, financial systems, data management systems… These systems, according to a representative of the NCSC Center, will be a priority target for hackers, from that perform more dangerous attacks.

Therefore, in order to ensure information security for the information systems of agencies, organizations and enterprises, and contribute to keeping Vietnam’s cyberspace safe, the Information Security Administration recommends that the units check, review the information system potentially affected by the above vulnerability and make a plan for handling and remediation.

In case affected by vulnerability CVE-2022-1388, units need to update the patch in time to avoid the risk of being attacked. “The best way to fix it is to update the patch for the security hole according to the company’s instructions. If the patch cannot be updated, the unit needs to take alternative remedial steps to reduce the risk of attacks such as blocking access to iControl REST through the IP address, blocking access to iControl REST through the management interface. manage, modify BIG-IP httpd configuration”NCSC experts guide.

In addition, the Department of Information Security also suggested that agencies, organizations and enterprises review the entire information system of their units, regularly check and evaluate to proactively detect and promptly handle them. time of security holes.

At the same time, strengthen monitoring and prepare a plan to handle when detecting signs of network exploitation or attack; regularly monitor the warning channels of authorities and large organizations on information security to promptly detect the risks of network attacks.

In case of necessity, agencies, organizations and businesses can contact the support focal point of the Information Security Department, directly the National Cyber ​​Security Monitoring Center – NCSC at phone number 02432091616 and email [email protected].

Van Anh