TMUI RCE vulnerability CVE-2020-5902
In BIG-IP versions 15.0.0-18.104.22.168, 14.1.0-22.214.171.124, 13.1.0-126.96.36.199, 12.1.0-188.8.131.52, and 11.6.1-184.108.40.206, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.
Vulnerability CVE-2020-5902 received a CVSS score of 10(most severe score).
F5 recommends upgrading to a fixed software version to fully mitigate this vulnerability(CVE-2020-5902). For more information:
Press release April 2023: Situational Security Alerts from CIRT
21 Apr 2023 - Articles, English articles, News, Notice, Security Advisories & Alerts
Security Best Practices
29 Mar 2023 - Security Advisories & Alerts