An authenticated attacker who holds the Resource Administrator or Administrator role on F5 BIG‑IP can use iControl SOAP to modify configuration objects, thereby elevating privileges and gaining full control over the system. The flaw arises from insufficient enforcement of permission checks on SOAP endpoints, allowing configuration changes that would normally be restricted.

All actively supported F5 BIG‑IP devices are vulnerable, as the issue applies to any version that has not reached End of Technical Support. No specific version ranges were listed, so all releases within the supported lifecycle should be considered at risk.

The CVSS score of 8.5 indicates high severity, and although the EPSS score is not available, the lack of a KEV listing does not diminish the potential impact. The vulnerability requires an authenticated user, so an attacker must first compromise legitimate credentials or gain access through another vector that allows role assignment. Once authenticated, the attacker can change critical configuration settings, potentially compromising network security and availability.