// For flags

CVE-2025-31644

Appliance mode BIG-IP iControl REST and tmsh vulnerability

Severity Score

8.5
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

F5 BIG-IP version 16.1.4.1 suffers from a command injection vulnerability via an authenticated user with administrator privileges.

*Credits: F5 acknowledges Matei "Mal" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
High
Low
Integrity
High
Low
Availability
None
Low
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2025-04-23 CVE Reserved
  • 2025-05-07 CVE Published
  • 2025-05-11 First Exploit
  • 2025-05-15 CVE Updated
  • 2025-06-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
F5
Search vendor "F5"
 BIG-IP
Search vendor "F5" for product "BIG-IP"
 >= 17.1.0.0 < 17.1.2.2
Search vendor "F5" for product "BIG-IP" and version " >= 17.1.0.0 < 17.1.2.2"
en
Affected
F5
Search vendor "F5"
 BIG-IP
Search vendor "F5" for product "BIG-IP"
 >= 16.1.0 < 16.1.6
Search vendor "F5" for product "BIG-IP" and version " >= 16.1.0 < 16.1.6"
en
Affected
F5
Search vendor "F5"
 BIG-IP
Search vendor "F5" for product "BIG-IP"
 >= 15.1.0.0 < 15.1.10.7
Search vendor "F5" for product "BIG-IP" and version " >= 15.1.0.0 < 15.1.10.7"
en
Affected