The flaw exists in F5 BIG‑IP’s Configuration utility and permits a low‑privileged authenticated user to view sensitive data on pages that are not intended for public disclosure. The vulnerability stems from inadequate validation of page requests, leading to unintended exposure of confidential configuration information. The result is a confidentiality breach, potentially revealing sensitive system details to an attacker with non‑admin credentials.

The affected product is F5 BIG‑IP. No specific version range is supplied in the advisory, and End of Technical Support releases have not been evaluated. Administrators should verify that their installed BIG‑IP instances are on supported releases and consult the F5 advisory at my.f5.com for detailed guidance.

Based on the description, it is inferred that the attacker must first obtain a legitimate user account and then navigate the Configuration utility. The CVSS score of 7.1 indicates a high potential for significant impact if exploited. The EPSS score is not available, so the likelihood of real‑world exploitation cannot be quantified, yet the presence of the issue in a widely deployed service and the moderate score warrant serious attention. The vulnerability is not listed in the CISA KEV catalog. The combination of a medium‑to‑high severity rating and the absence of mitigation evidence suggests that organizations should treat this as a critical concern and prioritize remediation.