F5 BIG-IP CVE-2025-54755

Exploitation requires the attacker to already be a highly privileged (administrative) authenticated user of the F5 BIG-IP TMUI (Traffic Management User Interface) web management console, consistent with PR:H in the CVSS vector. This high-privilege prerequisite is the primary limiting factor: the flaw cannot be triggered by an unauthenticated or low-privileged remote user, so realistic exposure depends on whether the management interface is network-reachable and whether admin credentials are shared with lower-trust operators. No user interaction is required (UI:N) and no special non-default product feature is named in the description - the traversal applies to the TMUI file-access handling. Impact is limited to unauthorized file reads (confidentiality); there is no stated integrity or availability effect.

This is a moderate-priority issue, not an emergency. The F5-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) scores 6.9 (Medium) and the signals are internally consistent: network-reachable but gated behind PR:H, meaning the attacker must already hold high (administrative) privileges on the TMUI interface. Impact is confidentiality-only (VC:H, no integrity or availability impact), consistent with a directory-traversal file-read primitive (CWE-22). EPSS is 1.19% (67th percentile) - low-to-moderate, reflecting no mass-exploitation pressure. There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict: a high-privilege prerequisite naturally suppresses both EPSS and widespread attacker interest. The main real-world risk is a semi-trusted or compromised administrator escalating file access beyond intended boundaries, or a traversal flaw chained after a separate authentication bypass. Treat as a routine patch-cycle item unless the appliance's admin interface is broadly exposed or shares credentials with lower-trust operators. Note: the single F5 advisory (K000156801) is the only reference, so affected fix versions were not independently verified here.

An attacker who already holds high-privilege administrative credentials on the BIG-IP TMUI interface submits a crafted request containing directory-traversal sequences to read files outside the intended scope, such as configuration or credential material. No public exploit code is referenced, and because exploitation requires existing privileged authentication, the realistic path is an insider, a compromised admin account, or chaining after a separate auth bypass.