EUVD-2026-29978
GHSA-v83q-vrmw-32xv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
Privilege escalation in F5 BIG-IP allows authenticated Resource Administrators to gain full Administrator privileges by exploiting insecure iControl SOAP API configuration handling. Attackers with high-privilege Resource Administrator access can modify configuration objects to escalate to Administrator level, achieving cross-scope access to confidential data and integrity compromise. EPSS risk assessment unavailable, but exploitation requires legitimate Resource Administrator credentials and network access to management interface, limiting attack surface to insider threats or compromised administrative accounts.
Technical ContextAI
F5 BIG-IP's iControl SOAP API provides programmatic access to device configuration management. The vulnerability stems from CWE-552 (Files or Directories Accessible to External Parties), where the API fails to properly restrict Resource Administrator role permissions when modifying certain configuration objects through SOAP requests. The iControl interface is F5's legacy XML-based management API (predating the newer iControl REST), commonly used for automation and integration with orchestration tools. The insecure permission model allows role boundary violations, where lower-privileged administrative roles can manipulate configuration data that should be restricted to full Administrators, effectively bypassing F5's role-based access control (RBAC) implementation.
RemediationAI
Apply vendor-released patches detailed in F5 Security Advisory K000160979 available at https://my.f5.com/manage/s/article/K000160979. F5 typically provides hotfix releases for currently supported BIG-IP versions addressing the insecure iControl SOAP permission validation. Organizations should prioritize patching systems where Resource Administrator role is actively delegated to multiple users or third-party integrations. If immediate patching is infeasible, implement compensating controls: restrict iControl SOAP API access to only full Administrator accounts by modifying authentication profiles, disable iControl SOAP entirely if only iControl REST is required (check automation dependencies first - legacy integrations may break), enforce IP-based access restrictions to management interfaces allowing only trusted jump hosts, enable audit logging for all iControl SOAP configuration changes to detect privilege escalation attempts, and conduct access review to verify Resource Administrator role assignments follow least-privilege principles. Note that disabling iControl SOAP will impact any automation tools using the legacy XML API rather than the REST interface.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Tra
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today