CVE-2024-37028
📋 TL;DR
CVE-2024-37028 allows attackers to lock out administrator accounts on BIG-IP Next Central Manager that have never been logged in. This affects organizations using F5's BIG-IP Next Central Manager for network management. The vulnerability enables denial of service against administrative access.
💻 Affected Systems
- F5 BIG-IP Next Central Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical administrative accounts become permanently inaccessible, requiring manual intervention and potentially disrupting network management operations.
Likely Case
Temporary denial of service against administrative interfaces, requiring account unlock procedures and causing operational delays.
If Mitigated
Minimal impact with proper account management and monitoring in place.
🎯 Exploit Status
Exploitation requires some level of access to target accounts but doesn't require authentication to the vulnerable accounts themselves.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.2.0 and later
Vendor Advisory: https://my.f5.com/manage/s/article/K000139938
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download and install BIG-IP Next Central Manager version 20.2.0 or later from F5 Downloads. 3. Follow F5's upgrade documentation for BIG-IP Next Central Manager. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Account Login Enforcement
allEnsure all administrator accounts have been logged into at least once to prevent exploitation.
🧯 If You Can't Patch
- Monitor administrator account login attempts and lockout events in system logs
- Implement strict access controls to limit who can attempt authentication to administrative interfaces
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP Next Central Manager version via web interface or CLI. Versions below 20.2.0 are vulnerable.Check Version:
From CLI: show version | grep -i 'big-ip next central manager'Verify Fix Applied:
Verify version is 20.2.0 or later and test that previously unused administrator accounts cannot be locked out.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts on administrator accounts that have never been logged in
- Account lockout events for unused administrative accounts
Network Indicators:
- Unusual authentication traffic patterns to administrative interfaces
SIEM Query:
source="big-ip" AND (event_type="authentication_failure" OR event_type="account_lockout") AND user="admin*"