EUVD-2026-29959
GHSA-9657-qhh9-38mw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
3DescriptionCVE.org
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
AnalysisAI
BIG-IP DNS provisioning exposes SSH passwords in cleartext within iControl REST API responses and audit logs when using the gtm_add and bigip_add commands, allowing highly privileged authenticated attackers with audit log access to retrieve sensitive credentials. The vulnerability affects all supported BIG-IP DNS versions and carries a CVSS score of 4.4 with low real-world exploitation risk due to the requirement for local access and high privilege level.
Technical ContextAI
F5 BIG-IP DNS is a DNS management system that uses iControl REST as its primary API interface for remote administration. The gtm_add and bigip_add REST commands are used to provision and configure Global Traffic Management (GTM) and BIG-IP appliance settings. The vulnerability stems from improper output encoding (CWE-312: Cleartext Storage of Sensitive Information) where the ssh-password parameter-a sensitive authentication credential-is returned unencrypted in API responses and persisted in plaintext within the audit log. This violates secure credential handling practices and creates a secondary information disclosure risk through the audit logging system, which is typically designed to have broad administrative visibility.
RemediationAI
F5 has released a patch that addresses the cleartext exposure of SSH passwords in iControl REST responses and audit logs. Apply the vendor-released patch from F5 article K000158070 (https://my.f5.com/manage/s/article/K000158070), which contains corrected versions of BIG-IP DNS with proper credential redaction in REST API responses and audit logging. As an immediate compensating control, restrict access to the iControl REST API and audit logs to only the minimum set of administrators who require it; use network segmentation or host-based firewall rules to limit which systems can query the REST interface and which accounts can access audit logs. Additionally, rotate any SSH credentials that may have been exposed during the window of vulnerability to invalidate credentials that could be recovered from historical logs or API responses. Monitor audit logs for suspicious access patterns indicative of credential harvesting, though this is limited if the attacker already has audit log access. Note: these compensating controls reduce but do not eliminate the risk if an attacker already has high privilege access.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today