Big Ip Advanced Web Application Firewall
CVE-2025-20029
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.7, EPSS 66.2%. F5 BIG-IP is deployed as the front door for enterprise applications, handling SSL termination, load balancing, and WAF functions. Compromise of BIG-IP provides access to TLS private keys (enabling traffic decryption), application server addresses (bypassing WAF), and the ability to modify traffic in transit. |
| Exploit ScenarioDerived | An attacker with valid BIG-IP credentials (obtained through credential stuffing or phishing) uses the iControl REST API to issue a save command with injected shell code. The commands execute on the BIG-IP, and the attacker extracts TLS private keys, modifies load balancing rules to redirect traffic, and installs a persistent backdoor on the appliance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authenticated attackers can inject system commands through crafted save operations, executing arbitrary code on the BIG-IP appliance which typically handles load balancing and SSL termination for critical application infrastructure.
Earlier versions of this analysis (1)
Authenticated command injection in F5 BIG-IP iControl REST and tmsh save command enables arbitrary system command execution on the load balancer.
RemediationAI
Apply the latest F5 security hotfix. Restrict iControl REST access to management networks only. Implement multi-factor authentication for BIG-IP admin access. Monitor tmsh command logs for unusual save operations. Rotate TLS certificates if compromise is suspected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The tmsh save command processes user-supplied parameters without adequate sanitization before passing them to underlying system commands. An authenticated user with access to iControl REST or tmsh can inject shell metacharacters that execute arbitrary commands. BIG-IP appliances run a modified Linux OS and the exploitation context provides access to TLS private keys, configuration secrets, and network traffic.
Know when Big Ip Advanced Web Application Firewall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
CVE-2025-20029 presents significant security risk, a OS command injection vulnerability rated CVSS 8.7. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. With an EPSS score of 66%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdow
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclose
GitHub PoC
Exploit-DB