Technical impact
An authenticated attacker who holds the Resource Administrator or Administrator role on an F5 BIG‑IP device can use the iControl SOAP interface to create SNMP configuration objects, thereby gaining elevated privileges. The flaw is a classic command injection vulnerability (CWE‑78), allowing an attacker to execute arbitrary commands through the SOAP payload. This escalation can lead to full system compromise if the attacker subsequently uses the newly granted SNMP objects to manipulate device settings or access sensitive data.
Affected Systems
All F5 BIG‑IP software that supports the iControl SOAP interface is affected by this vulnerability. Versions that have reached End of Technical Support are not evaluated, so any supported release that has not yet been patched remains at risk.
Risk and Exploitability
The CVSS score of 8.5 categorizes the flaw as high severity. No EPSS score is available, and it is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that no confirmed public exploitation has been reported yet. However, because the attack requires legitimate credentials with specific administrative roles, the exploitability largely depends on the privilege level of compromised accounts. An attacker who can obtain or masquerade as a Resource Administrator or Administrator will be able to create malicious SNMP objects and elevate their access rights, potentially leading to full system compromise.
