CVE-2025-31644
Appliance mode BIG-IP iControl REST and tmsh vulnerability
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Appliance mode BIG-IP iControl REST and tmsh vulnerability
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Reserved 2025-04-23 | Published 2025-05-07 | Updated 2025-05-15 | Assigner f5CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
F5 acknowledges Matei "Mal" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure.
my.f5.com/manage/s/article/K000148591
Support options
