The vulnerability manifests in iControl REST on F5 BIG-IP when a user possessing the Manager role commands the creation of configuration objects. The objects can be crafted to run arbitrary commands on the device’s operating system, effectively giving the authenticated attacker full command-line control. This flaw is rooted in improper validation of object contents, allowing privileged users to instruct the system to execute unmanaged code, a classic example of an arbitrary code execution vulnerability.

Affected systems are F5 BIG-IP appliances that expose iControl REST and have not yet migrated away from versions within the supported technical support window. The advisory specifically notes that software versions which have reached End of Technical Support are not evaluated, so only currently supported releases are at risk.

The CVSS score of 8.6 classifies this issue as high severity. EPSS data is not available, and the vulnerability does not appear in the CISA KEV catalog. The attack requires an authenticated user with Manager-level permissions; therefore, the primary attack vector is a privileged attacker who can already log in to the REST API. Once the role is obtained, the victim may conduct lateral movement or install persistent backdoors via the command shell, leading to full compromise of the BIG-IP device.