F5 BIG-IP Vulnerability Allows Remote Command Execution

Critical security vulnerability in F5 BIG-IP systems has been discovered that allows authenticated administrators to execute arbitrary system commands, effectively bypassing security boundaries.

Identified as CVE-2025-31644, the command injection flaw affects multiple versions of BIG-IP running in Appliance mode.

Security researcher Matei “Mal” Badanoiu from Deloitte responsibly disclosed the issue to F5, which has now released patches for affected systems.

The vulnerability has been classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command Injection.

Technical analysis reveals that the flaw exists within an undisclosed iControl REST endpoint and BIG-IP TMOS Shell (tmsh) command that fails to properly sanitize user inputs.

When exploited, this vulnerability allows authenticated attackers with administrator privileges to execute arbitrary Advanced Shell (bash) commands, creating a significant security bypass mechanism.

Security experts note that successful exploitation enables attackers to create or delete files and execute system commands through either the BIG-IP management port or self IP addresses.

This represents a serious control plane security issue, though F5 clarifies there is no data plane exposure.

The vulnerability specifically targets BIG-IP systems operating in Appliance mode, which can be enforced either by specific licensing or enabled on individual Virtual Clustered Multiprocessing (vCMP) guest instances.

Affected Systems and Severity Ratings

F5 has assigned high severity ratings to this vulnerability, with a CVSS v3.1 score of 8.7 and a CVSS v4.0 .

The vulnerability has been tracked internally by F5 Product Development under IDs 1778741, 1702565, and 15832011.

Notably, F5’s assessment confirms that other products in their portfolio are not vulnerable, including BIG-IP Next, BIG-IQ Centralized Management, F5 Distributed Cloud services, F5OS, and NGINX products.

Organizations using these unaffected products can maintain normal operations while focusing remediation efforts on vulnerable BIG-IP installations.

Recommended Mitigation Strategies

F5 has released patched versions to address the vulnerability: 17.1.2.2 for the 17.x branch, 16.1.6 for the 16.x branch, and 15.1.10.7 for the 15.x branch.

Security administrators are strongly advised to upgrade to these fixed versions at their earliest opportunity.

For organizations unable to immediately update, F5 recommends several temporary mitigation measures.

Since the attack requires authenticated administrator access, the most effective mitigation is to restrict system access to only fully trusted users.

Additional technical controls include blocking iControl REST access through self IP addresses by changing Port Lockdown settings to “Allow None” and implementing similar restrictions for SSH access.

Network administrators can further harden security by restricting management interface access using packet filtering functionality or implementing network firewall rules as detailed in F5’s knowledge base articles K46122561 and K693540491.

These measures effectively reduce the attack surface by limiting access to trusted networks and devices only.

Security teams should note that implementing some of these mitigation techniques may impact high availability configurations and other services, requiring careful planning before deployment.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!