Technical impact
The vulnerability resides in an undisclosed TMOS Shell (tmsh) command within BIG‑IP DNS and allows a highly privileged authenticated attacker to view sensitive information. This flaw is a confidentiality breach based on CWE‑312, which denotes insecure handling of inputs. The impact is that an attacker can read data that should remain restricted to authorized administrators, potentially exposing configuration or operational details that could be leveraged for further attacks.
Affected Systems
F5 BIG‑IP systems that have the DNS feature provisioned are affected. Specific product naming is limited to the vendor’s BIG‑IP platform, and no particular software version is listed; end‑of‑technical‑support versions are explicitly excluded from the assessment but are not detailed here.
Risk and Exploitability
The CVSS score of 6.7 indicates a medium severity impact primarily affecting confidentiality. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog, suggesting no widely known exploits at this time. The attack requires authenticated access with elevated privileges, so the risk is contingent on privilege escalation or existing access. Given the lack of public exploitation evidence, the immediate threat is moderate, but the sensitive nature of the disclosed information warrants timely action.
