Technical impact
The vulnerability is a directory traversal flaw in an undisclosed iControl REST endpoint that is active only when the device runs in Appliance mode. If an attacker can authenticate with administrator privileges, the endpoint can be exploited to delete arbitrary files by providing a path that traverses directories. The impact is loss of system or configuration files that the device relies on for operation.
Affected Systems
F5 BIG‑IP appliances operating in Appliance mode are affected. The CVE description does not specify affected firmware versions; however, the advisory notes that only supported versions are evaluated. Administrators should confirm whether their deployment is running in Appliance mode and whether it is on a supported firmware release.
Risk and Exploitability
The CVSS score of 6.9 indicates medium severity. EPSS is not available, so exploitation likelihood is unknown. The flaw is not listed in the CISA KEV catalog. The vulnerability requires valid administrator credentials and authenticated access; therefore, an attacker must first obtain privileged access before the directory traversal can be used to delete files.
