K55792317 : BIG-IP management vulnerability CVE-2016-9250

Security Advisory Description

In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism. (CVE-2016-9250)

Impact

An unauthenticated user with access to the management control plane may be able to delete arbitrary files through an undisclosed mechanism. There is control plane exposure for the web Configuration utility, iControl REST, and iControl SOAP. There is no data plane exposure.