The vulnerability is an authenticated remote command injection in an iControl REST endpoint that serves the big‑picture function of F5 BIG‑IP Appliance mode. The flaw allows an attacker who can authenticate to the appliance to execute arbitrary operating‑system commands and cross the appliance’s security boundary. This results in full control of the device, as the attacker can gain privileged access to the underlying operating system and data stores.

The affected product is F5 BIG‑IP in Appliance mode. Specific product names would be the BIG‑IP; no software version information has been supplied, so it is not possible to identify unaffected releases from the data provided.

The CVSS score of 8.5 indicates a high severity level. While the EPSS score is unavailable, the lack of a KEV listing suggests no current widespread exploitation, yet the command injection capability remains a high‑impact vulnerability. The attack requires valid authentication, so internal or privileged network access is likely needed to exploit the flaw. The weakness is catalogued as CWE‑78, pointing to insufficient filtering of user input used in system commands. Given the ability to execute arbitrary code, the fix should be applied as a priority.