A flaw in the iControl SOAP interface allows an authenticated attacker possessing the Resource Administrator or Administrator role to retrieve sensitive files from the F5 BIG‑IP system. The vulnerability enables unauthorized disclosure of data that could include configuration, documentation, or logs, thereby compromising confidentiality and potentially aiding further attacks. The weakness maps to a permissions issue where privileged users can read files beyond their intended scope (CWE‑552).

The affected product is F5 BIG‑IP. Software versions that have reached End of Technical Support are not evaluated for this issue.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation at this time. Exploitation requires a valid authenticated session with at least Resource Administrator or Administrator rights, and the attacker must be able to send SOAP requests to the target system. Once accessed, the attacker can download any readable file from the file system via the SOAP interface.