March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – Urgent Windows Update to Patch Two Critical Flaws
July 2, 2020
Rewterz Threat Advisory – CVE-2020-3391 – Cisco Digital Network Architecture Center Information Disclosure Vulnerability
July 3, 2020
Rewterz Threat Advisory – Urgent Windows Update to Patch Two Critical Flaws
July 2, 2020
Rewterz Threat Advisory – CVE-2020-3391 – Cisco Digital Network Architecture Center Information Disclosure Vulnerability
July 3, 2020
Severity
High
Analysis Summary
CVE-2020-5902
This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable. This issue is not exposed on the data plane; only the control plane is affected.
CVE-2020-5903
An attacker can exploit this vulnerability to run JavaScript in the context of the currently logged-in user. In the case of an administrative user with access to the Advanced Shell (bash), successful exploitation of this vulnerability can be leveraged to completely compromise the BIG-IP system through Remote Code Execution.
Impact
System compromise
Affected Vendors
F5
Affected Products
BIG-IP
Remediation
Refer to F5 advisory for the list of affected products and respective patches.