In BIG-IP CVE-2020-5902
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2021 - Broken Access Control
ASVS 5.0
V4 - Access Control Authorization enforcement, RBAC validation
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 9.8, EPSS 94.4%). BIG-IP appliances sit at the network perimeter handling traffic for critical applications. Root compromise gives attackers access to all traffic flowing through the device, including credentials, session tokens, and sensitive data. Mass exploitation began within hours of PoC release. |
| Exploit ScenarioDerived | An attacker identifies an internet-facing BIG-IP management interface, sends a crafted URL with path traversal to reach the internal hsqldb endpoint. The resulting Java code execution runs as root, enabling full device compromise, traffic interception, and lateral movement into backend servers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary system commands with root privileges through crafted URL requests.
Earlier versions of this analysis (1)
A critical remote code execution vulnerability in F5 BIG-IP's TMUI (Configuration utility) allows unauthenticated attackers to execute commands as root through path traversal in URL requests. This affected an estimated 8,000+ internet-exposed instances.
RemediationAI
Apply F5 hotfixes immediately. Restrict management interface access to trusted networks. Never expose TMUI to the internet. Check for indicators of compromise including modified configuration and unauthorized user accounts.
Affected ProductsAI
F5 BIG-IP 15.0.0-15.1.0.3 F5 BIG-IP 14.1.0-14.1.2.5 F5 BIG-IP 13.1.0-13.1.3.3 F5 BIG-IP 12.1.0-12.1.5.1 F5 BIG-IP 11.6.1-11.6.5.1
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-22 path traversal in TMUI's request handler allows attackers to bypass authentication and reach internal API endpoints. By crafting URLs with specific path traversal sequences, attackers can invoke the hsqldb endpoint to execute arbitrary Java code, which runs as the root user.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Executive ViewAI
Organizations using BIG-IP face critical risk from CVE-2020-5902, a path traversal vulnerability rated CVSS 9.8. This could allow attackers to access or modify files outside intended directories, potentially exposing sensitive configuration or credentials. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict file upload functionality via WAF; (2) Implement allowlist-based file type validation; (3) Use chroot/containerization to limit filesystem access.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.