TMUI RCE vulnerability CVE-2020-5902
In BIG-IP versions 15.0.0-126.96.36.199, 14.1.0-188.8.131.52, 13.1.0-184.108.40.206, 12.1.0-220.127.116.11, and 11.6.1-18.104.22.168, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.
Vulnerability CVE-2020-5902 received a CVSS score of 10(most severe score).
F5 recommends upgrading to a fixed software version to fully mitigate this vulnerability(CVE-2020-5902). For more information:
02 Nov 2022 - Security Advisories & Alerts
20 Oct 2022 - Security Advisories & Alerts