8.8

CVE-2025-20029

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Advanced Firewall Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Analytics Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Application Acceleration Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Application Security Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Application Visibility And Reporting Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Automation Toolchain Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Carrier-grade Nat Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Container Ingress Services Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Domain Name System Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Edge Gateway Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Fraud Protection Service Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Global Traffic Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Link Controller Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Local Traffic Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Policy Enforcement Manager Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Ssl Orchestrator Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Webaccelerator Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Websafe Version >= 15.1.0 < 15.1.10.6
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Application Visibility And Reporting Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Automation Toolchain Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Carrier-grade Nat Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Container Ingress Services Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Edge Gateway Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Webaccelerator Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Websafe Version >= 16.1.0 < 16.1.5.2
F5 ≫ Big-ip Access Policy Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Advanced Web Application Firewall Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Analytics Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Application Security Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Application Visibility And Reporting Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Automation Toolchain Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Carrier-grade Nat Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Container Ingress Services Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Domain Name System Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Edge Gateway Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Fraud Protection Service Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Global Traffic Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Link Controller Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Local Traffic Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Webaccelerator Version >= 17.1.0 < 17.1.2.1
F5 ≫ Big-ip Websafe Version >= 17.1.0 < 17.1.2.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 48.96% 0.976
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f5sirt@f5.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
f5sirt@f5.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.