CyberzSOC

Four of these vulnerabilities have been classified as high severity due to their potential to facilitate session hijacking and to lead to Denial-of-Service (DoS) attacks. [1,2] CVE-2024-39809, with a CVSS score 8.9, is a vulnerability that facilitates session hijacking. It allows an attacker who obtains a user’s session cookie to continue using that session to access the BIG-IP Next Central Manager and managed systems, even after the user logs out. This vulnerability impacts the control plane, enabling unauthorised access without affecting data CVE-2024-39778, with a CVSS score 8.7, allows a remote, unauthenticated attacker to trigger a system reboot, disrupting traffic and causing a denial-of-service (DoS) on the BIG-IP system. While this vulnerability affects the data plane by interrupting service, there is no control exposure [4]. CVE-2024-39792, with a CVSS score 8.7, allows a remote, unauthenticated attacker to degrade the performance of the NGINX service until the master and worker processes are restarted.