TMUI RCE vulnerability CVE-2020-5902


In BIG-IP versions 15.0.0-, 14.1.0-, 13.1.0-, 12.1.0-, and 11.6.1-, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.


This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.
Vulnerability CVE-2020-5902 received a CVSS score of 10(most severe score). 


F5 recommends upgrading to a fixed software version to fully mitigate this vulnerability(CVE-2020-5902). For more information: