F5 BIG-IP
CVE-2025-61958
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain resource-admin credentials
-
DeliveryAuthenticate to BIG-IP tmsh
-
ExploitInvoke iHealth command
-
ExecutionBypass tmsh restriction to bash
-
PersistCross Appliance-mode boundary
-
ImpactExecute arbitrary OS commands
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Exploitation requires an authenticated account holding at least the resource administrator role on the BIG-IP system (PR:H) - it is not exploitable by anonymous or low-privilege users. The critical security-boundary impact applies specifically to BIG-IP systems configured in Appliance mode, where tmsh confinement is the enforced control; on systems not in Appliance mode the bash access is less of a boundary crossing. Software versions past End of Technical Support (EoTS) were not evaluated and may or may not be affected. No user interaction by a second party is required. |
| Impact | This is a genuine but access-gated privilege-escalation issue rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) scores 8.5 (High), but the single most important limiting signal is PR:H - the attacker must already hold at least a resource administrator role on the BIG-IP. This is not a pre-auth internet takeover; it is an authorized high-privilege user escaping tmsh confinement to a bash shell. EPSS is low at 0.39% (31st percentile), consistent with no public exploit and no CISA KEV listing. There is no SSVC decision data in the input. The real-world weight comes from deployment context: it only 'crosses a security boundary' on systems running in Appliance mode, where the tmsh/bash separation is the security control. On non-Appliance-mode systems, a resource admin reaching bash is far less of a boundary violation. Net: real priority only for organizations running BIG-IP in Appliance mode who rely on role separation; otherwise it is a High-CVSS-but-moderate-real-risk local hardening issue. No signals conflict, though note the assessed impact assumes the resource-admin account is a meaningfully restricted role, which it is under Appliance mode. |
| Exploit ScenarioDerived | An attacker who has obtained resource-administrator credentials (e.g., a rogue insider, a compromised operator account, or a lower-trust tenant admin on an Appliance-mode BIG-IP) invokes the iHealth command to break out of the restricted tmsh shell into an interactive bash shell. On an Appliance-mode device this crosses the intended security boundary, giving full underlying-OS command execution and defeating the role-based confinement. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An authenticated attacker holding at least the resource administrator role on an F5 BIG-IP system can use the iHealth command to escape the tmsh restricted shell and obtain a full bash shell, a privilege escalation rated CVSS 4.0 8.5 (and CVSS 3.1 8.5, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). The impact is most severe on BIG-IP systems running in Appliance mode, where tmsh confinement is the enforced control and successful exploitation lets the attacker cross a security boundary; on systems not in Appliance mode the bash access is correspondingly less consequential. There is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low (0.39%, 31st percentile), making this an access-gated privilege-escalation issue rather than a mass-exploitation threat. Administered roles and the Appliance mode setting are the primary gating factors.
RemediationAI
Apply the fix identified in F5's advisory K000154647 (https://my.f5.com/manage/s/article/K000154647); no exact fixed version is specified in the available input data, so administrators must read the advisory's version matrix and upgrade or hotfix each affected BIG-IP module to the listed fixed release - note that releases past End of Technical Support were never evaluated and should be treated as unsupported and upgraded as a matter of course. Because exploitation requires an authenticated account with at least the resource administrator role, the highest-value compensating control is strict role hygiene: audit and prune accounts holding resource administrator, remove that role from service, automation and third-party accounts that do not genuinely need it, enforce MFA, and treat any resource administrator credential theft as a path to full appliance compromise. Where an immediate upgrade is not possible, consider restricting management-plane access to trusted administrative networks and monitoring BIG-IP audit logs for iHealth invocations followed by bash/shell process activity or unexpected child processes under tmsh - the trade-off is that this is detection rather than prevention and will not stop a determined insider, and blocking management access too broadly can break legitimate administration and automation. Disabling or wrapping the iHealth diagnostic utility is a possible hardening step but may remove useful troubleshooting capability and can be reverted by any account that can write to the relevant paths; disabling Appliance mode is not an acceptable mitigation because it weakens the platform's confinement model globally rather than addressing this specific escape.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-250 (Execution with Unnecessary Privileges): the iHealth diagnostic command within BIG-IP's tmsh management shell executes with more privilege than its function requires, so a caller who is legitimately authorized for tmsh commands can chain it to spawn an unrestricted bash shell instead of remaining inside the constrained tmsh environment. tmsh is the Traffic Management Shell used to configure and monitor BIG-IP objects, and on systems provisioned in Appliance mode it is intended to be the hard boundary between administrative configuration access and the underlying Linux operating system - normally a resource administrator is deliberately prevented from reaching a general-purpose shell. By converting an in-shell command invocation into arbitrary OS-level execution, the vulnerability turns a bounded administrative role into root-level or near-root-level access to the appliance filesystem and services. The CPE data confirms the issue spans essentially the entire BIG-IP software module family (Access Policy Manager, Advanced Firewall Manager, Advanced WAF, Analytics, Application Acceleration Manager, Application Security Manager, Application Visibility and Reporting, Automation Toolchain, Carrier-Grade NAT, Container Ingress Services and others), meaning the defect is in the shared BIG-IP platform/management layer rather than in any single add-on module. Versions that have reached End of Technical Support were not evaluated and may or may not be affected.
Know when Big Ip Advanced Web Application Firewall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable management access with an existing resource-admin role gives PR:H/AC:L; escaping Appliance-mode tmsh confinement to host bash is a scope change (S:C) yielding full C/I, with no availability impact claimed.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
A privilege-escalation flaw in F5 BIG-IP (CVE-2025-61958, CVSS 8.5) allows someone who already holds the resource administrator role to break out of the restricted tmsh shell and gain a full bash shell on the device. Because BIG-IP systems often sit inline with production traffic and, in Appliance mode, rely on that shell confinement as an enforced security boundary, successful abuse could give an insider or compromised admin account complete control over a critical network appliance. Leadership should care primarily about who currently holds that role and how many of these devices are deployed in Appliance mode.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly limit and regularly audit accounts holding the resource administrator role; enforce least privilege and remove unnecessary high-privilege assignments; restrict management-plane access to trusted networks; enable and centrally monitor logging for iHealth command use and tmsh-to-bash transitions; and review Appliance mode deployments, where shell confinement is the enforced control, for additional segmentation. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdow
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
GitHub PoC
Exploit-DB