F5 BIG-IP

F5 BIG-IP RCE (CVE-2021-22986): The 9.8 Edge Emergency

Post author:Prabhu Kalyan Samal
Post published:March 19, 2021
Post category:Cloud & Infrastructure Security Web & API Security

A CVSS 9.8 unauthenticated RCE in BIG-IP iControl REST was mass-exploited within a day of disclosure — web shells, credential theft, coinminers on the boxes that hold your TLS keys. The edge-device patch-race case study.