8.7 High

CVE-2025-31644 Appliance mode BIG-IP iControl REST and tmsh vulnerability

Description

When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: High
Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
BIG-IP 17.5	earliest → < 17.5.0	17.5.0
BIG-IP 17.1	17.1.0 → < 17.1.2.2	17.1.2.2
BIG-IP 16.1	16.1.0 → < 16.1.6	16.1.6
BIG-IP 15.1	15.1.0 → < 15.1.10.7	15.1.10.7

References

my.f5.com my.f5.com

Timeline

Published May 7, 2025
Last modified November 3, 2026

The 259 CVEs of BIG-IP →

CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability 9.8 Critical CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts… 8.8 High CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error… 3.1 Low CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory… 7.5 High

Track this CVE