Maverc
All articlesVulnerabilities

Active Exploitation of Critical Security Flaws in F5's BIG-IP Software (CVE-2023-46747)

November 27, 20235 min readMaverc Threat Research · Threat Advisory
VulnerabilitiesRansomwareCloud SecurityNetwork Security
Active Exploitation of Critical Security Flaws in F5's BIG-IP Software (CVE-2023-46747)

An unauthenticated attacker with network access to BIG-IP's management plane can execute arbitrary system commands. Restrict access and patch immediately.

CVE-2023-46747 is a critical authentication bypass and remote code execution vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI). It allows an unauthenticated attacker with network access to the BIG-IP management port or self IP addresses to execute arbitrary system commands. There is no data plane exposure — this is a control plane issue only — but the impact on a compromised load balancer is severe.

What to Do Now

  • Apply the F5 hotfix or upgrade to a fixed engineering build immediately.
  • Ensure the management port and self IPs are not exposed to the internet or untrusted networks. F5 has long recommended this; the CVE is a hard reminder.
  • Audit TMUI access logs for unexpected POST requests to the relevant endpoints.
  • If exposure to attackers is suspected, treat the device as compromised: rebuild from known-good images and rotate all secrets that the device touched.

Edge appliances continue to be a primary initial-access vector for ransomware crews. Management interfaces should be reachable only from a hardened bastion or out-of-band network.

Keep reading

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack
Identity Security

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack

Push-based MFA was a decade-old patch on a broken model. Here's how AiTM toolkits like EvilProxy and Tycoon 2FA defeat it — and the phishing-resistant controls that actually stop them.

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had
Compliance

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had

If you handle CUI, the C3PAO assessment is coming. Here's the 10-step readiness path Maverc walks every defense industrial base client through before the auditor shows up.

What a Modern OT Ransomware Attack Looks Like — And How to Survive One
OT / ICS Security

What a Modern OT Ransomware Attack Looks Like — And How to Survive One

From IT pivot to PLC shutdown, today's OT ransomware crews follow a repeatable playbook. Here is what we see in the field and the segmentation controls that contain the blast.