{"uuid": "8a305354-bd64-4200-82d0-a4537dd40753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23031", "type": "seen", "source": "https://t.me/hacking_Attack/21599", "content": "Black Hat Ethical Hacking\nF5 Bug Could Lead to Complete System Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png F5 Bug Could Lead to Complete System TakeoverPost Views: 17 \nReading Time: 2 Minutes\nApplication delivery and networking firm F5 released a baker\u2019s dozen of 13 fixes for high-severity bugs, including one that could lead to complete system takeover and hence is boosted to \u201ccritical\u201d for customers that run BIG-IP in Appliance Mode\nF5 \u2013 maker of near-ubiquitously installed enterprise networking gear \u2013 released nearly 30 vulnerabilities for multiple devices in its August security updates.\n\nThe worst of the bunch is tracked as CVE-2021-23031\u00a0and affects BIG-IP modules Advanced WAF (Web Application Firewall) and the Application Security Manager (ASM) \u2013 specifically, the Traffic Management User Interface (TMUI).\n\nF5 said that when the vulnerability is exploited, \u201can authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services,\u201d potentially leading to \u201ccomplete system compromise.\u201d\n\nCVE-2021-23031 normally entails a high rating of 8.8 severity, but that gets jacked up to 9.9 for just those customers that are using Appliance mode. The Appliance mode adds technical restrictions and is designed to meet the needs of customers in \u201cespecially sensitive sectors\u201d by \u201climiting the BIG-IP system administrative access to match that of a typical network appliance and not a multi-user UNIX device.\u201d\n\nF5 lists a number of products that contain the affected code but aren\u2019t vulnerable, given that attackers can\u2019t exploit the code in default, standard or recommended configurations. F5 noted that there are a limited number of customers using it in the mode \u2013 i.e., Appliance mode \u2013 that elevates the vulnerability\u2019s CVSSv3 severity score to 9.9 (critical).\nSee Also: Complete Offensive Security and Ethical Hacking Course No Viable MitigationF5 said that there\u2019s \u201cno viable mitigation\u201d that also allows users access to the Configuration utility, given that this attack can be pulled off by legitimate, authenticated users. The only way to mitigate is to pull the access of any users who aren\u2019t \u201ccompletely trusted,\u201d according to the advisory.\n\nCustomers who can\u2019t install a fixed version right off the bat can use the following temporary mitigations, which restrict access to the Configuration utility to only trusted networks or devices and thereby limit the attack surface:\n\n* Block Configuration utility access through self IP addresses\n* Block Configuration utility access through the management interface\n\nMichael Haugh, Vice President at network automation provider Gluware, told Threatpost that known vulnerabilities are challenging to respond to quickly or to mitigate speedily: As it is, network operation crews are \u201cunder\u00a0the gun to keep the network highly available, secure and delivering the required performance for the business applications,\u201d he said. \u201cVendor vulnerabilities that require an OS Upgrade or patch can be very labor-intensive and potentially disruptive.\u201d\n\nVia email, Haugh observed that when it comes to a load balancer like F5, redundancy \u201cmust be part of the device\u201d and traffic \u201cmust be re-directed off an active device, taking it out of service to perform an upgrade.\u201d\n\nNot just once, mind you, but, often, multiple times: \u201cThis process often has to be repeated over dozens or even hundreds of devices depending on the organization. Having automated processes to pre-check, stage the image, gracefully execute the upgrades and complete post-checks can significantly improve the ability for NetOps to respond and execute a low-risk upgrade.\u201d\nSee Also: Critical[...]", "creation_timestamp": "2026-09-01T20:02:27.266395Z"}