F5 BIG-IP CVE-2025-59481

Requires an authenticated session on BIG-IP with at least the Resource Administrator role, exercised through either the iControl REST API or the TMOS Shell (tmsh). Exploitation is therefore limited to users already granted administrative-tier access (or attackers who have compromised such an account); it is not reachable by anonymous or low-privilege users. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5 and should be treated as potentially affected. The limiting factors are the high privilege prerequisite (PR:H) and the need for a specific role, which substantially narrow the realistic attacker population to insiders or post-compromise escalation.

This is a privilege-escalation flaw (CWE-250, execution with unnecessary privileges) in F5 BIG-IP where an undisclosed iControl REST / tmsh command lets an attacker who already holds at least the Resource Administrator role execute arbitrary system commands at a higher privilege level, crossing a security boundary. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) confirms the attack is network-reachable with low complexity but REQUIRES high privileges (PR:H) - this is the decisive risk-limiter: an attacker must already be an authenticated administrative-tier user, so it is a post-authentication escalation rather than a remote-unauthenticated takeover. Real-world risk signals are mixed-to-moderate: EPSS is low at 0.39% (31st percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no evidence of widespread exploitation. The 8.5/HIGH score is driven by the high confidentiality and integrity impact once the privilege barrier is crossed, not by ease of initial access. Net assessment: a genuine but gated issue - serious in environments where lower-trust operators are granted the Resource Administrator role, but lower urgency than a pre-auth RCE. No conflicting signals in the data; the PR:H requirement is consistent across the F5 vector and the description's 'authenticated attacker with at least resource administrator role.'

An authenticated BIG-IP user holding the Resource Administrator role (for example a delegated operator or a compromised administrative account) issues the undisclosed command through the iControl REST API or the tmsh shell. The command executes with higher privileges than the user's role should permit, allowing the attacker to run arbitrary system commands and cross a security boundary to gain fuller control of the appliance. No public proof-of-concept is referenced, and low attack complexity means a knowledgeable insider or account-takeover attacker could reliably trigger it.