The Cybersecurity and Infrastructure Security Agency (CISA) and F5 Technologies published an advisory to warn about a critical vulnerability affecting the F5 BIG-IP Traffic Management User Interface. If exploited, this flaw could allow unauthenticated attackers to send undisclosed requests bypassing authentication, in order to perform arbitrary code execution, potentially leading to a total system takeover. BIG-IP has multiple functionalities, acting as a network load balancer, and full proxy allowing for the inspection, encryption, and decryption of any network traffic that passes through a particular network. The flaw, tracked as CVE-2022-1388, lies in the iControl REST component, which allows for rapid communication between users and F5 BIG-IP devices, with a low system resource cost. This vulnerability poses an even greater risk due to the popularity of F5 BIG-IP use by enterprise organizations. Threat actors may begin exploiting this vulnerability to gain initial access to the target network, allowing them to move laterally and conduct other malicious activity. Scans with Shodan, a popular IoT search engine, indicate that there are currently 16,142 F5 BIG-IP systems susceptible to attack, mainly located in the US, followed by China, India, Australia, and Japan. F5 has released security patches for all versions of BIG-IP except 12.1.0 – 12.1.6 and 11.6.1 – 11.6.5 and urges any administrators or users deploying an unsecure version to upgrade to the latest fix immediately. Due to its enterprise popularity, many organizations using F5 BIG-IP may not be able to patch their networks immediately because of the potential impact to business processes. In those cases, F5 has offered three (3) manual exploit mitigation techniques. The F5 and CISA advisory states that depending on the organization’s capabilities, administrators can block all access to the iControl REST component, restrict the management interface to only allow access to trusted users and devices, or modify the configuration of BIG-IP httpd. CTIX analysts predict that it will only be a matter of time before threat actors identify the location of this vulnerability, and we expect to see a steady increase in scans for this flaw in the coming months. Analysts urge any and all customers deploying vulnerable instances of F5 BIG-IP to upgrade to the latest secure version or apply one of the three (3) mitigations listed above.