CVE-2025-20029

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029

CVE-2025-20029 is a command-injection vulnerability in BIG-IP iControl REST and the tmsh shell. An authenticated user could execute arbitrary system commands, e.g., via a crafted HTTP POST to the iControl REST endpoint /mgmt/tm/util/bash with a JSON payload such as {"command": "id"}, potentially ...

CVE-2025-20029 BIG-IP iControl REST and tmsh vulnerability

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029 BIG-IP iControl REST and tmsh vulnerability

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-23239

CVE-2025-23239 affects BIG-IP iControl REST. In Appliance mode, an authenticated user with high privileges can exploit an undisclosed iControl REST endpoint to execute arbitrary commands, crossing a security boundary. Impact is command injection on the control plane with administrator-like privil...

CVE-2025-23239 BIG-IP iControl REST vulnerability

When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached E...

CVE-2025-23239 BIG-IP iControl REST vulnerability

When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached E...

K000148587: BIG-IP iControl REST and tmsh vulnerability CVE-2025-20029

Security Advisory Description A command injection vulnerability exists in iControl REST and the BIG-IP TMOS Shell tmsh, which may allow an authenticated attacker to execute arbitrary system commands. CVE-2025-20029 Impact An authenticated attacker may exploit this vulnerability by sending a craft...

F5 Networks BIG-IP : BIG-IP iControl REST vulnerability (K000138757)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.2. It is, therefore, affected by a vulnerability as referenced in the K000138757 advisory. When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection...

F5 iControl REST和F5 BIG-IP TMOS Shell 操作系统命令注入漏洞

F5 iControl REST and F5 BIG-IP TMOS Shell are both products of F5 Corporation, U.S.A. F5 iControl REST is a development framework. and F5 BIG-IP TMOS Shell is a command line. An operating system command injection vulnerability exists in F5 iControl REST and F5 BIG-IP TMOS Shell that stems from th...

F5 Networks BIG-IP : BIG-IP iControl REST and tmsh vulnerability (K000148587)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.6 / 16.1.5.2 / 17.1.2.1. It is, therefore, affected by a vulnerability as referenced in the K000148587 advisory. A command injection vulnerability exists in iControl REST and the BIG-IP TMOS Shell tmsh, which may...

F5 Networks BIG-IP : BIG-IP iControl REST vulnerability (K10438187)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.5 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K10438187 advisory. Undisclosed requests to BIG-IP iControl REST can lead to an information leak of user account names.CVE-2024-41723...

CVE-2024-41723

Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41723

Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-41723

CVE-2024-41723 affects BIG-IP iControl REST. A remote authenticated attacker with network access can view only usernames in the BIG-IP system via the iControl REST interface; there is no data plane exposure (control plane issue). Affected product versions are listed in F5 advisory: BIG-IP Next/ B...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 A remote code execution vulnerability exi...

CVE-2024-22093 Appliance mode iControl REST vulnerability

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical...

CVE-2024-22093 Appliance mode iControl REST vulnerability

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical...

CVE-2024-22093

The CVE-2024-22093 issue affects BIG-IP in Appliance mode where an authenticated attacker can exploit an undisclosed iControl REST endpoint to perform remote command injection and cross the security boundary. Affected versions include BIG-IP Next/BIG-IP (all modules) on 17.x with fixes in 17.1.1,...

CVE-2024-22389 BIG-IP iControl REST API Vulnerability

When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...