Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Title F5 BIG-IP contains multiple vulnerabilities including unauthenticated remote command execution
Name VU#290915 First vendor Publication 2020-07-08
Vendor VU-CERT Last vendor Modification 2020-07-13
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 9.8
Base Score 9.8 Environmental Score 9.8
impact SubScore 5.9 Temporal Score 9.8
Exploitabality Sub Score 3.9
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores



F5 BIG-IP provides a Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that has multiple vulnerabilities including a remotely exploitable command injection vulnerability that can be used to execute arbitrary commands and subsequently take control of a vulnerable system.


F5 BIG-IP devices provide load-balancing capability to application services such as HTTP and DNS. The F5 BIG-IP TMUI management web interface improperly neutralizes untrusted user input and can be abused by unauthenticated remote attackers to perform malicious activities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and command injection CWE-74. F5 has also announced that BIG-IP devices do not properly enforce access controls to sensitive configuration files that be read and overwritten by an authenticated user via Secure Copy (SCP). The vulnerability identified by CVE-2020-0592 can be abused to achieve arbitrary code execution on the target device with root privileges.

Underlying causes and factors in these vulnerabilities include:

  • Improper configuration and a lack of identify checks, see recent article from NCC Group. Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902
  • The TMUI fails to enforce proper authentication and authorization, see OWASP Recommendations
  • The TMUI web interface does not normalize user's input to prevent both XSS and CSRF, allowing a "Deadly Combinations of XSS and CSRF"
  • Lack of role-based access checks allows for for unexpected file access, see Role-Based Access Control Models

F5 recommends that the TMUI web interface should be accessible only from a secure or an out-of-band network and not directly from the Internet (K13092). However, many installations, as observed by Bad Packets, do not seem to follow this recommendation.


An unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device.


Apply updates

F5 has provided updated software for the several impacted versions of BIG-IP devices. Note that BIG-IP appliances as well as virtual instances are also vulnerable as identified by F5 advisories. It is highly recommended that you upgrade to the latest secure and stable software provided by F5. These updates are essential to your device's security, even if the TMUI is not accessible over the Internet. The upgrade reduces the risk to your device being compromised using CSRF or XSS attacks.


In many cases, an attack against BIG-IP's recent vulnerabilities require access to TMUI. Blocking or disabling access to TMUI from untrusted networks is highly recommended. F5 has also provided multiple temporary workaround options in their advisory.


Several of these vulnerabilities were reported by Mikhail Klyuchnikov of Positive Technologies, who worked with F5 on a coordinated disclosure.

This document was written by Vijay Sarvepalli.

Original Source

Url : https://kb.cert.org/vuls/id/290915

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
17 % CWE-532 Information Leak Through Log Files
17 % CWE-352 Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
17 % CWE-276 Incorrect Default Permissions
17 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

Application 123
Application 114
Application 10
Application 116
Application 109
Application 134
Application 10
Application 111
Application 103
Application 128
Application 125
Application 129
Application 114
Application 10
Hardware 7
Hardware 6

Snort® IPS/IDS

Date Description
2020-08-11 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54484 - Revision : 2 - Type : SERVER-WEBAPP
2020-08-06 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54462 - Revision : 3 - Type : SERVER-WEBAPP

Alert History

If you want to see full details history, please login or register.
Date Informations
2020-07-13 17:17:27
  • Multiple Updates
2020-07-09 00:28:23
  • Multiple Updates
2020-07-09 00:17:28
  • First insertion