The vulnerability is an authenticated weakness that allows an attacker with low‑privilege iControl REST credentials to create or modify any file on a BIG‑IQ system through an undisclosed REST endpoint. Because this affects the file system directly, an attacker could overwrite configuration files, inject malicious scripts, or otherwise corrupt system state, compromising integrity. The weakness is a directory traversal type flaw (CWE‑22), where input validation is insufficient for path controls. The impact is that the attacker's normal privileges are boosted to effectively write arbitrary files, exposing the system to potential malicious code deployment.

The affected system is F5 BIG‑IQ. No specific version constraints are listed; however, versions that have reached End of Technical Support are excluded from evaluation, so only supported releases are affected.

The CVSS score of 7.2 indicates a moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV catalog. Attack requires valid user credentials but low privilege, so the likelihood of exploitation within a compromised environment is significant, especially if permissions are misconfigured. The file‑write capability provides a footholt that could lead to further attacks if the attacker can execute code or modify configurations. Network isolation and least‑privilege access are recommended to limit the risk.