An authenticated attacker using the iControl REST API can cause an information leak of BIG‑IP local account names, but not passwords. This weakness, classified as CWE‑732 for insufficient privilege checks, permits enumeration of user accounts, which may be leveraged for subsequent credential‑guessing or social engineering. The disclosure presents a moderate confidentiality risk but does not compromise credentials or system integrity.

The vulnerability affects F5 BIG‑IP devices running any supported release that has not reached End of Technical Support. Specific affected versions are not listed in the advisory, so administrators should verify if their current image contains the latest patch for the iControl REST API.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, making it unclear how frequently the flaw is exploited in the wild. Attackers need valid credentials to send requests to the REST interface, implying either a compromised local user or remote access with credentials is required. Because the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation, but the exposure of account names can aid in privileged escalation or phishing campaigns.