F5 patches severe flaws in BIG-IP Next Central Manager
Learn More
F5 has patched two high-severity vulnerabilities in the BIG-IP Next Central Manager, both of which could allow attackers to take administrative control of devices and create hidden rogue accounts on managed assets.
These vulnerabilities are tracked as:
- CVE-2024-26026 (CVSS score 7.5): An SQL injection vulnerability that could be exploited to execute arbitrary SQL commands, potentially leading to unauthorized access and control over the system.
- CVE-2024-21793 (CVSS score 7.5): An OData injection vulnerability that could be exploited to manipulate OData queries and execute unauthorized commands.
These flaws could enable unauthenticated attackers to remotely execute malicious SQL statements, gain full administrative rights and establish persistent backdoors in the form of invisible accounts on any BIG-IP Next asset managed by the affected Central Manager.
Eclypsium security researchers have released PoC for the flaws.
F5 released patches in version 20.2.0 of the software to fix these vulnerabilities. If users are unable to immediately apply the patch should restrict access to the Next Central Manager to trusted zones as a temporary mitigation strategy.
