Week of May 2, 2022: F5 BIG-IP Flaw and Five New KEV Entries, Ransomware Hits Colleges

The week of May 2, 2022 brought a cluster of urgent patching deadlines for security leaders, as CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog and F5 disclosed a critical BIG-IP authentication bypass tracked as CVE-2022-1388. Cisco and Mozilla also pushed out security fixes for enterprise and browser software, while ransomware attacks forced Kellogg Community College and Austin Peay State University to cancel exams and take systems offline during final-exam week.

Cisco Patches Multiple Flaws in Enterprise NFV Infrastructure Software

Cisco issued security updates addressing multiple vulnerabilities in its Enterprise NFV Infrastructure Software, used to manage virtualized network functions in service provider and enterprise environments. CISA warned that an attacker could exploit the flaws to take control of an affected system and pointed administrators to Cisco advisory cisco-sa-NFVIS-MUL-7DySRX9 for patching details. The agency encouraged users and administrators to apply the necessary updates promptly, treating the release as part of a broader set of Cisco fixes issued that week for lower-severity issues as well. (CISA)

CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog

CISA added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian executive branch agencies must remediate catalog entries by set deadlines to protect their networks from known attack vectors. CISA reiterated that although the directive applies only to federal agencies, all organizations should prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management, since these flaws represent a frequent and significant risk across both government and private-sector networks. (CISA)

F5 Discloses Critical BIG-IP Authentication Bypass, CVE-2022-1388

F5 published security advisories covering multiple vulnerabilities across its product line, including several versions of BIG-IP. The most severe, CVE-2022-1388, allowed undisclosed requests to bypass iControl REST authentication, letting an attacker take control of an affected system. CISA urged users and administrators to consult F5's overview of its May 2022 vulnerabilities and apply the necessary updates or workarounds without delay, given the potential for full system compromise on exposed BIG-IP deployments. (CISA)

Mozilla Patches Firefox 100, Firefox ESR, and Thunderbird

Mozilla shipped security updates for Firefox 100, Firefox ESR 91.9, and Thunderbird 91.9 to close vulnerabilities that an attacker could exploit to take control of an affected system. CISA flagged the releases and directed users and administrators to Mozilla's advisories for each product, recommending prompt installation of the patched versions across enterprise desktop fleets running the affected browser and mail client builds. (CISA)

Ransomware Disrupts Final Exams at Two U.S. Colleges

Ransomware attacks disrupted the close of the spring semester at Kellogg Community College in Michigan and Austin Peay State University in Tennessee. Austin Peay canceled final exams before resuming them and said graduation would still take place on May 6 as scheduled, while declining to pay any ransom and bringing in an outside firm to assess data exposure. Kellogg closed all five of its campuses, forced password resets, and kept systems offline while it investigated whether personal data had been accessed. (Higher Ed Dive)