F5
A United States-based network application delivery and security company. Its principal products include the BIG-IP series of application delivery controllers and security appliances, which are widely deployed for enterprise network edge traffic management and identity authentication scenarios.
Timeline (last 90 days)
F5 AI Gateway is part of the F5 platform, uses a commercial license, currently offers SaaS and hybrid deployment, and air-gapped deployment is planned.
The three detection indicators listed by F5 are: multiple OAuth authentication failures, followed by suspicious commands, followed closely by a TMM SIGABRT—when these three appear in close temporal proximity, they should serve as grounds for further investigation.
The quantitative detection criterion provided by F5 is: the sustained presence of ten or more OAuth failure entries in a single log warrants review, especially when each entry originates from the same IP address.
F5 released the patch in the form of engineering hotfixes, with affected branches including 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3.
The F5 advisory confirms that the vulnerability has been exploited, and a notice on the same issue from New York State also indicates that F5 has confirmed the existence of in-the-wild exploitation.
When immediate upgrading is not possible, F5 provides an iRule via support ticket to restrict malicious traffic patterns on affected virtual servers.
The vulnerability was discovered internally by F5, falls under the vendor-originated discovery category, and had no confirmed third-party proof-of-concept (PoC) when it entered the federal catalog on September 22.
The hotfix version for the 21.1.0 branch is Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.
All Facts (8)
F5 AI Gateway is part of the F5 platform, uses a commercial license, currently offers SaaS and hybrid deployment, and air-gapped deployment is planned.
50%UnverifiedThe three detection indicators listed by F5 are: multiple OAuth authentication failures, followed by suspicious commands, followed closely by a TMM SIGABRT—when these three appear in close temporal proximity, they should serve as grounds for further investigation.
50%UnverifiedThe quantitative detection criterion provided by F5 is: the sustained presence of ten or more OAuth failure entries in a single log warrants review, especially when each entry originates from the same IP address.
50%UnverifiedThe F5 advisory confirms that the vulnerability has been exploited, and a notice on the same issue from New York State also indicates that F5 has confirmed the existence of in-the-wild exploitation.
50%UnverifiedWhen immediate upgrading is not possible, F5 provides an iRule via support ticket to restrict malicious traffic patterns on affected virtual servers.
50%UnverifiedThe vulnerability was discovered internally by F5, falls under the vendor-originated discovery category, and had no confirmed third-party proof-of-concept (PoC) when it entered the federal catalog on September 22.
50%UnverifiedThe hotfix version for the 21.1.0 branch is Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.
50%UnverifiedF5 released the patch in the form of engineering hotfixes, with affected branches including 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3.
50%