A vulnerability exists in F5 Networks' BIG‑IP and BIG‑IQ systems that permits a highly privileged authenticated attacker with at least a Resource Administrator role to create SNMP configuration objects through the iControl REST API or the TMOS Shell (tmsh). This flaw enables the attacker to elevate privileges beyond the intended limits, effectively granting unauthorized access to privileged operations. The weakness is an example of CWE-77, where improper command validation allows manipulation of system behavior.

Both the BIG‑IP web application delivery controller and the BIG‑IQ application security management platform are affected. Specific version information was not provided, and software that has reached End of Technical Support is excluded from the evaluation.

The vulnerability carries a CVSS score of 8.5, qualifying it as high severity, yet it is not currently listed in CISA’s KEV catalog. The EPSS score is not available, and the attack requires an authenticated account with sufficient privileges, meaning that external attackers cannot exploit it without prior compromise. Once the attacker can create SNMP configuration objects, they can raise their own privileges and potentially control network traffic, leading to broader compromise of the managed infrastructure.