Technical impact
Incorrect permission assignment in iControl REST and the tmsh shell allows an authenticated attacker to read sensitive configuration or operational data in F5 BIG‑IP systems. The weakness is catalogued as CWE-732. By bypassing intended access controls, an attacker can expose confidential information that should be restricted to privileged users, thereby compromising the confidentiality of network device settings and potentially enabling further lateral movement.
Affected Systems
The affected vendor is F5 Networks, specifically the BIG‑IP product family. No specific version numbers are listed in the advisory, and the note indicates that software that has reached End of Technical Support has not been evaluated. Administrators should review the linked advisory for the exact supported releases that contain the flaw.
Risk and Exploitability
The CVSS score of 7.1 classifies the vulnerability as high severity. EPSS data is not available, so the exact likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need a valid authenticated session, which limits exploitation to users with access to iControl REST or the tmsh shell, but once authenticated, the incorrect permission assignment permits retrieval of protected data.
