An authenticated remote code execution vulnerability exists in the BIG‑IP and BIG‑IQ Configuration utility, allowing an attacker who can authenticate to the system to execute arbitrary code, potentially compromising confidentiality, integrity, and availability of the device. This weakness is classified as CWE‑502, indicating a flaw in binary input handling that can be abused to inject malicious code. The description explicitly states the vulnerability is exploitable through undisclosed vectors, implying the exact attack path is not publicly known but is available to those with valid credentials.

This vulnerability impact F5 BIG‑IP and BIG‑IQ devices. No specific software versions are listed, and any versions that have reached End of Technical Support are not evaluated. Administrators should verify the current firmware or software revision on their managed devices to determine applicability.

The CVSS score of 8.7 classifies this issue as high severity. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog does not diminish the threat of an authenticated attacker obtaining remote code execution via the configuration utility. The exploit would require valid credentials and access to the configuration interface, suggesting that strong authentication controls, network segmentation, and timely patching are critical to mitigate this risk.