peter bassill · operator
$ cve CVE-2020-5902 JSON

CVE-2020-5902 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS100% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-22
On CISA KEVyes — remediate by 2022-05-03
Public exploityes
Published2020-07-01
Last modified2026-06-17

CISA KEV

NameF5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Added2021-11-03
Due2022-05-03
Vendor / productF5 / BIG-IP
Ransomware useknown

Affected (14)

VendorProduct
f5big-ip access policy manager
f5big-ip advanced firewall manager
f5big-ip advanced web application firewall
f5big-ip analytics
f5big-ip application acceleration manager
f5big-ip application security manager
f5big-ip ddos hybrid defender
f5big-ip domain name system
f5big-ip fraud protection service
f5big-ip global traffic manager
f5big-ip link controller
f5big-ip local traffic manager
f5big-ip policy enforcement manager
f5ssl orchestrator

Public exploits

SourceTitleDate
exploit-dbF5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion2020-07-26
exploit-dbBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution2020-07-06
exploit-dbBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC)2020-07-05

References

→ the Explorer  ·  watch your stack  ·  NVD