If You’re Going to Spray My Exploit… (CVE-2022-41800)

This report describes honeypot-captured scanning and exploitation attempts against F5 BIG-IP management endpoints, documenting hits against tmui and /mgmt APIs. Observed activity includes CVE-2022-1388 auth-bypass RCE exploit patterns, SSRF-related attempts for CVE-2021-22986, and use of a PoC payload targeting CVE-2022-41800 (rpm-spec-creator). The author analyzes HTTP requests, captured POST bodies, and notes attackers reusing public PoC strings, providing concrete indicators and context for remediation.