SSH Access Vulnerability in F5 BIG-IP Appliances by F5 Networks

CVE-2012-1493

Summary

F5 BIG-IP appliances prior to specified versions expose a single SSH private key shared among multiple installations, allowing remote attackers to exploit weak access controls. This vulnerability enables unauthorized SSH logins via the PubkeyAuthentication method, posing significant security risks as attackers can leverage this flaw to access sensitive customer installations.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2012-1493
Created by Rapid7

References