EUVD-2026-29998
GHSA-5jw2-vqxm-5fmx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
3DescriptionCVE.org
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
F5 BIG-IP DNS when provisioned contains an undisclosed TMOS Shell (tmsh) command vulnerability allowing highly privileged authenticated attackers to view sensitive information. The vulnerability requires high-privilege account access and local shell access (AV:L, PR:H), limiting real-world exploitation to insider threats or post-compromise scenarios where an attacker has already obtained administrative credentials on the management interface.
Technical ContextAI
BIG-IP DNS is F5's managed DNS solution built on the TMOS (Traffic Management Operating System) platform. The vulnerability resides in an undisclosed tmsh command-a command-line shell for BIG-IP management and configuration. TMOS shells typically provide low-level access to system internals and configuration data. CWE-312 (Cleartext Storage of Sensitive Information) indicates the root cause involves sensitive data exposure through a command that lacks proper access controls or output sanitization. The exact command remains undisclosed by the vendor, preventing detailed technical analysis.
RemediationAI
Apply vendor-released patch from F5 KB article K000157981 (https://my.f5.com/manage/s/article/K000157981). Exact patched version numbers not provided in available data-consult the referenced F5 article for applicable patch versions by product line and release. Until patching is feasible, implement strict administrative access controls: restrict tmsh command shell access to named administrators only, enforce multi-factor authentication on BIG-IP management accounts, restrict management interface network access to authorized administrative subnets via firewall rules, and audit tmsh command execution logs for unauthorized sensitive information queries. Monitor for suspicious tmsh activity via audit logs or SIEM integration. These controls reduce attack surface but do not eliminate the vulnerability for privileged accounts.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today