The vulnerability resides in the iControl REST endpoint and the TMOS Shell (tmsh) command. An attacker who is authenticated and holds a resource administrator role can view sensitive data that should be restricted. The flaw is a classic information disclosure weakness classified as CWE-200, exposing confidential configuration or operational data but not providing direct code execution capabilities.

The affected products are F5 BIG‑IP and F5 BIG‑IQ. No specific product versions are listed in the advisory or CNA data, so all deployed instances that include the iControl REST service and tmsh command should be considered at risk until the vendor issues a fix.

The CVSS score of 6.9 indicates a medium impact. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the attack requires an authenticated resource administrator account, the primary attack vector is internal or opportunistic exploitation of compromised credentials. The likelihood of exploitation depends on the security posture of the environment—detailed attack capabilities are not documented in the CVE description.