VULNERABILITY INTELLIGENCE
CVE-2020-5902
CVSS score9.8 CRITICAL
EPSS probability100.00%
CISA KEVKnown exploited vulnerability
Published2020-07-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Vendor / product: F5 / BIG-IP
Description
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Weakness classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary references
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory, VDB Entry
- f5sirt@f5.com — Exploit, Third Party Advisory
- f5sirt@f5.com — Broken Link, Exploit, Third Party Advisory
- f5sirt@f5.com — Vendor Advisory
- f5sirt@f5.com — Exploit, Third Party Advisory
- f5sirt@f5.com — Exploit, Third Party Advisory
- f5sirt@f5.com — Third Party Advisory, US Government Resource