EUVD-2026-29998
GHSA-5jw2-vqxm-5fmx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f5) · only source for this CVE.
CVSS VectorVendor: f5
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
F5 BIG-IP DNS when provisioned contains an undisclosed TMOS Shell (tmsh) command vulnerability allowing highly privileged authenticated attackers to view sensitive information. The vulnerability requires high-privilege account access and local shell access (AV:L, PR:H), limiting real-world exploitation to insider threats or post-compromise scenarios where an attacker has already obtained administrative credentials on the management interface.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following: (1) High-privilege authenticated account on BIG-IP DNS management interface (administrator or equivalent role); (2) Local shell access to TMOS command line (tmsh) on the BIG-IP DNS system-either direct console/SSH or privileged remote shell session; (3) Knowledge of or discovery of the undisclosed tmsh command syntax; (4) BIG-IP DNS must be provisioned (active) with DNS functionality enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.4 with AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates LOW real-world risk despite HIGH confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An internal IT administrator or contracted support engineer with legitimate access to BIG-IP DNS management credentials uses the undisclosed tmsh command to extract sensitive DNS configuration, zone data, or DNSSEC keys from the system and exfiltrates them to an external attacker. Alternatively, an external attacker compromises a BIG-IP administrator's credentials through phishing or password reuse, gains local shell access to the management interface, and runs the tmsh command to harvest sensitive information without triggering typical API audit logs. |
| Remediation | Apply vendor-released patch from F5 KB article K000157981 (https://my.f5.com/manage/s/article/K000157981). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles
F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Tra
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today