The vulnerability stems from improper permission assignments in F5 BIG‑IP and BIG‑IQ TMOS Shell (tmsh) network diagnostics commands and BIG‑IP iControl REST. An authenticated attacker who can log into the device can exploit these flaws to view the network status of destination systems, thereby accessing sensitive operational data. The weakness is captured by CWE‑732, which denotes incorrect permissions or access control.

The affected products are F5 BIG‑IP and F5 BIG‑IQ. No specific version information is provided in the advisory; therefore, any instance that includes the vulnerable tmsh network diagnostics or iControl REST functionality should be considered at risk, especially those still receiving support.

With a CVSS score of 6.8, the vulnerability is of medium severity. While no EPSS score is available, the lack of a KEV designation suggests there has been no confirmed exploitation detected to date. However, an attacker must be authenticated to exploit the flaw, implying that compromised accounts or privileged users could be leveraged to gain the disclosed information. The attack vector is likely an authenticated session that accesses the diagnostic commands or REST endpoints, and success depends on the incorrect permission assignments present in the affected configurations.