Technical impact
The vulnerability arises from incorrect permission assignments applied to the TMOS Shell arp and ndp commands and the iControl REST interface on F5 BIG‑IP and BIG‑IQ devices. An attacker who can authenticate to the device can read adjacent network information such as MAC addresses and neighbor table entries. This flaw is a classic improper restriction of operations weakness (CWE‑732) that does not provide direct code execution or denial of service but exposes sensitive network state.
Affected Systems
F5 Network’s BIG‑IP appliance and BIG‑IQ management platform are affected, including their TMOS Shell (tmsh) commands and iControl REST API. No specific product versions are listed in the advisory, so any current model that has not reached End of Technical Support is potentially vulnerable.
Risk and Exploitability
The CVSS score of 6.8 indicates a moderate‑severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited at a large scale. Exploitation requires an attacker to be authenticated to the target system, either through the device’s local interface or via the iControl REST API. Once authenticated, the attacker can issue the privileged commands to exfiltrate network topology information.
