The vulnerability allows a highly privileged, authenticated attacker who can read audit logs to retrieve the ssh-password parameter in cleartext from the responses of the gtm_add and bigip_add iControl REST commands. This results in the disclosure of a sensitive credential, which could be used to gain further compromise of the managed device. The weakness is a cleartext storage of sensitive information (CWE‑312).

Products affected are F5 BIG‑IP devices when the BIG‑IP DNS feature is provisioned. The advisory does not list specific version ranges, but all supported releases that have the gtm_add and bigip_add commands are implicated. Versions that have reached End of Technical Support are not evaluated in this advisory.

The CVSS score of 6.7 indicates a medium severity, while no EPSS score is available and the vulnerability is not listed in KEV. The risk is that only an attacker with high privileged credentials and audit log access can exploit it, so the likelihood depends on internal segregation of duties. If such access is misconfigured or compromised, the attacker could exfiltrate SSH passwords and use them for lateral movement or further credential theft. The attack vector is inferred to be local or remote where the attacker can authenticate to the iControl REST interface and read audit logs.