K00091341 : TMOS Shell privilege escalation vulnerability CVE-2020-5907

Security Advisory Description

An authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality. (CVE-2020-5907)

Impact

A malicious actor who has gained access to a restricted account with tmsh access (for example, a user who hasTerminal Accessset totmshand notAdvanced shell) may be able to read or write to arbitrary files on the file system using the built-in sftp functionality and use that access to construct a privilege escalation attack in order to gain root access to the BIG-IP system.