BIG-IQ EUVD-2026-29957

Exploitation requires valid credentials for an authenticated iControl REST user account with low privileges (PR:L) on the BIG-IQ system. The vulnerable endpoint is exposed via the network-accessible iControl REST API (AV:N), which is typically enabled by default for management functions. No special configuration changes, non-default features, or user interaction (UI:N) are required beyond having API access enabled. Limiting factors include: the need for valid credentials (blocking completely unauthenticated attacks), network reachability to the BIG-IQ management interface (which should be restricted to management networks in proper deployments), and the attacker's knowledge of the undisclosed vulnerable endpoint (requiring API reconnaissance or insider knowledge). Organizations with properly segmented management networks and strong authentication controls face reduced risk compared to those with management interfaces exposed to broader networks.

This represents a significant risk to BIG-IQ deployments with multiple administrative users or service accounts. The CVSS 8.1 score accurately reflects high integrity and availability impact - arbitrary file write enables attackers to modify critical configurations, inject backdoors, or corrupt system files. Attack complexity is low (AC:L) with no user interaction required, making exploitation straightforward once authenticated access is obtained. The primary risk constraint is the authentication requirement (PR:L), but this is frequently satisfied in enterprise environments through compromised service accounts, insider threats, or chained exploitation from initial access vulnerabilities. No EPSS score provided, and no CISA KEV listing indicates this is not yet widely exploited in the wild. However, the combination of network reachability, low complexity, and clear path to system compromise makes this a priority patch for any organization using BIG-IQ, particularly those with multiple administrators or API integration points. The undisclosed nature of the vulnerable endpoint suggests F5 is limiting attacker reconnaissance opportunities, but skilled penetration testers or malicious insiders could identify the endpoint through API enumeration.

An attacker obtains credentials for a low-privilege iControl REST service account through phishing, credential stuffing, or compromise of an integrated monitoring tool. They authenticate to the BIG-IQ management interface and use API enumeration to identify the vulnerable endpoint. The attacker crafts a REST API request with a path traversal payload (e.g., '../../../../etc/cron.d/malicious') to write a malicious cron job that executes with root privileges, establishing persistent backdoor access to the BIG-IQ system and potentially pivoting to managed BIG-IP devices.