CISA warns of vulnerability in F5 BIG-IP products

The Cybersecurity and Infrastructure Security Agency Oct. 15 released an emergency directive advising federal agencies to take stock of their F5 BIG-IP application products, as a nation-state-affiliated cyberthreat actor has compromised F5’s systems and has stolen files, including a portion of the company’s BIG-IP source code and vulnerability information. CISA advised agencies to evaluate if their networked management interfaces are accessible from public internet, apply any updates from F5 and take additional mitigation actions outlined in the notice. 

“F5 devices and software are also ubiquitously used throughout the health care field as well as the federal government,” said John Riggi, AHA national advisor for cybersecurity and risk. “Although the federal directive does not apply to health care, it is strongly recommended that the same inventory, mitigation and patching procedures be applied by all health care entities affected by this major vulnerability. This incident, like the recent Oracle vulnerability, demonstrates that overreliance and presumed security of mission-critical third-party technologies may expose the field to increased risk.”

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.