Technical impact
A flaw in F5 BIG‑IP systems allows an attacker who already has administrative credentials to gain higher privileges. The vulnerability can be leveraged to cross a security boundary, potentially enabling the attacker to access services or data normally protected from that administrative account. The impact includes elevated privileges that could compromise confidentiality, integrity, and availability of the affected systems, as confirmed by the CWE‑121 indicator of a stack-based buffer overflow weakness.
Affected Systems
The vulnerability applies to F5 BIG‑IP devices that are not in End of Technical Support. No specific version information is provided in the advisory, so all supported BIG‑IP releases should be checked for the patch. Software versions that have reached EoTS are not evaluated in this advisory.
Risk and Exploitability
The CVSS score of 7.1 marks the vulnerability as high risk. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently undocumented. However, the attack vector requires an authenticated administrative user, indicating that local or remote users with such access could exploit the flaw. The lack of an unprivileged user attack path reduces the overall immediacy, but the elevated privileges would grant the attacker significant damage potential.
