On May the 4th, network security firm F5 published an overview of vulnerabilities affecting several of their products. Among these is CVE-2022-1388, which is rated as critical with a CVSSv3 score of 9.8. The Centre for Cyber Security Belgium recommends administrators of F5 BIG-IP network devices to check if their devices are affected according to the KB article and patch their devices as soon as possible if their devices are determined to be vulnerable.
In the scenario that it would not be possible to patch any time soon, F5 has provided mitigation guidance scenario’s on the KB article. Past incidents have shown that it does not take long for cyber threat actors to start scanning the public internet looking for devices that may be vulnerable to critical vulnerabilities in order to exploit them. Active exploits have already been observed.