Actively exploited in the wild
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
F5 - BIG-IP · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-5902
CriticalCVSS 9.8KEVSummary
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Risk Assessment
An attacker can remotely execute arbitrary code on the BIG-IP device, leading to full device compromise and potential breach of the entire network infrastructure.
Recommendation
Immediately apply F5 BIG-IP patches or restrict access to the TMUI interface to trusted networks only if updating is not possible.
Other vulnerabilities in F5 BIG-IP
See all- CVE-2016-9250High
In F5 BIG-IP versions 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.
- CVE-2016-9256High
In F5 BIG-IP versions 12.1.0 through 12.1.2, a race condition can occur that may delay the enforcement of permissions by iControl. If the role_map is not reloaded after permissions are changed, a user may gain access to resources they should not have access to.
- CVE-2016-9253High
In F5 BIG-IP versions 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
- CVE-2016-9251High
In F5 BIG-IP versions 12.0.0 through 12.1.2, an authenticated attacker may gain elevated privileges through a crafted iControl REST connection.
- CVE-2016-9252High
The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, allowing remote attackers to cause a denial-of-service (DoS) through unspecified vectors.
- CVE-2016-5020High
F5 BIG-IP versions before 12.0.0 HF3 allow remote authenticated users to modify the account configuration of users with the Resource Administration role, potentially gaining privileges via a crafted external Extended Application Verification (EAV) monitor script.
- CVE-2016-4545High
Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service through resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake.
- CVE-2023-46747CriticalActively exploited
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2022-1388CriticalActively exploited
In F5 BIG-IP versions 16.1.x prior to 16.1.2.2, 15.1.x prior to 15.1.5.1, 14.1.x prior to 14.1.4.6, 13.1.x prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. This allows an attacker to access the management interface without authentication.
- CVE-2021-22991CriticalActively exploited
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE).
Original NVD description (English source)
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.