EUVD-2026-29992
GHSA-qxf3-7mw3-hq68
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid credentials
-
DeliveryAuthenticate to BIG-IP/BIG-IQ
-
ExploitQuery iControl REST or tmsh diagnostics
-
ExecutionExtract network topology
-
PersistIdentify backend systems
-
ImpactEnumerate target infrastructure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Attacker must possess valid, authenticated credentials for BIG-IP or BIG-IQ (PR:L in CVSS vector). The tmsh network diagnostics commands and iControl REST diagnostics/monitoring endpoints must be accessible from the network (AV:N in CVSS vector indicates no local access required). No special configuration or non-default deployment mode is explicitly described; the vulnerability affects standard deployments where network diagnostics are enabled. The impact is limited to information disclosure (C:H/I:N/A:N); no modifications to system state or availability impact are possible via this vector alone. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates this is a remotely exploitable, low-complexity attack requiring low-level authentication with high confidentiality impact. While no KEV status or active exploitation data is provided, the requirement for prior authentication (PR:L) significantly reduces real-world risk compared to unauthenticated exploits, as it presupposes an attacker has already obtained valid credentials. However, the high confidentiality rating (C:H) paired with no integrity or availability impact suggests this is specifically a reconnaissance/information gathering vulnerability that could enable further attacks. EPSS data is absent; without exploitation probability metrics, reliance falls on CVSS scoring and the authenticated requirement as the primary risk moderators. Organizations should prioritize based on the sensitivity of network topology data in their environment and the number of users with authenticated access. |
| Exploit ScenarioDerived | A contractor with basic user credentials (e.g., read-only monitoring access) authenticates to the BIG-IP iControl REST API and queries the network diagnostics endpoints, discovering the internal IP addresses, DNS names, and connection status of backend servers that should be restricted to administrators only. The attacker exports this network topology data to map internal infrastructure, then uses it to plan targeted attacks against discovered backend systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 13, 2026
Incorrect permission assignment in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and iControl REST allows authenticated attackers to view network status of destination systems. Affected versions vary by product line; vendor has released patches. Authentication is required, limiting exposure to users with valid credentials, but the high confidentiality impact (CVSS 6.5) makes this a material information disclosure risk for organizations managing sensitive network infrastructure.
RemediationAI
Apply vendor-released patch from F5 as documented in https://my.f5.com/manage/s/article/K000161022. Exact patched versions are not enumerated in available data; consult the F5 advisory to identify the correct upgrade path for your specific BIG-IP or BIG-IQ version and product line. As an interim control, restrict API access to tmsh network diagnostics commands and iControl REST endpoints to trusted administrative subnets or restrict them at the load balancer/firewall level. Additionally, implement role-based access control (RBAC) enforcement in F5 console settings to ensure only administrators requiring network diagnostics access are granted those permissions, though this does not address the underlying permission assignment bug. Monitor authentication logs for suspicious access patterns to tmsh and iControl REST by low-privilege accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper access control enforcement (CWE-732) in two distinct F5 components: the TMOS Shell (tmsh) command-line interface used for system administration and diagnostics, and the iControl REST API which provides programmatic access to BIG-IP/BIG-IQ configuration and monitoring. The tmsh network diagnostics commands and iControl REST endpoints fail to properly validate that the authenticated user has the required permissions to view network status information, allowing privilege escalation or lateral access to sensitive network topology and status data that should be restricted by role-based access control policies.
Know when Big Ip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
Lifecycle Timeline
3DescriptionCVE.org
Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a r
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Exploit-DB