The Cybersecurity and Infrastructure Security Agency (CISA) warned that threat actors are actively exploiting unencrypted HTTP persistence cookies generated by F5 BIG-IP Local Traffic Manager (LTM) modules for network reconnaissance. Under default cookie persistence profiles, the LTM appliance encodes backend pool member IP addresses and listening ports into decimal integers using little-endian byte ordering (e.g., BIGipServer<pool_name>). Unauthenticated remote attackers intercept these session cookies, invert the byte sequence, and extract RFC 1918 private addresses and service ports of internal backend servers.

Adversaries leverage this information leakage to map enterprise network topologies and server segmentations behind reverse proxies without generating internal telemetry. CISA highlighted that threat actors use the decoded infrastructure maps to target unpatched internal services for lateral movement. To eliminate the exposure, F5 and CISA urge administrators to mandate cookie encryption with strong passphrases in BIG-IP LTM persistence and HTTP profiles, and audit configurations using the BIG-IP iHealth diagnostic utility.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Default cookie encoding leaks internal network layouts and backend addressing directly through perimeter proxies, neutralizing the defense-in-depth benefits of network address translation and ingress isolation.
• Bullet 2 — Strategic & Defender Imperative: Defenders must immediately mandate cookie encryption profiles across all BIG-IP virtual servers, run iHealth diagnostics to identify unencrypted persistence pools, and treat exposed backend addresses as reconnoitered attack targets.