A configuration weakness allows an authenticated privileged attacker with at least the Certificate Manager role to edit objects that enable execution of arbitrary commands. The flaw effectively permits the attacker to run commands with the authority of the affected system, potentially leading to full control of the environment. The vulnerability is classified as a privilege escalation error (CWE‑267).

The affected vendors are F5; the products are BIG‑IP and BIG‑IQ. No specific version information is provided, and versions that have reached End of Technical Support are not evaluated.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to be an authenticated user with the Certificate Manager role, so the primary attack vector is internal. The high CVSS, combined with the need for privileged access, still represents a significant risk to affected organizations.