9.8Kritisch KEV In Ransomware genutzt

CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

BIG-IP Veröffentlicht: 2020-07-01 03:00 (vor 6 Jahren)

Bekannt ausgenutzt — F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-5902

Beschreibung

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
f5	big-ip access policy manager	11.6.1 – < 11.6.5.2
f5	big-ip advanced firewall manager	11.6.1 – < 11.6.5.2
f5	big-ip advanced web application firewall	11.6.1 – < 11.6.5.2
f5	big-ip analytics	11.6.1 – < 11.6.5.2
f5	big-ip application acceleration manager	11.6.1 – < 11.6.5.2
f5	big-ip application security manager	11.6.1 – < 11.6.5.2
f5	big-ip ddos hybrid defender	11.6.1 – < 11.6.5.2
f5	big-ip domain name system	11.6.1 – < 11.6.5.2
f5	big-ip fraud protection service	11.6.1 – < 11.6.5.2
f5	big-ip global traffic manager	11.6.1 – < 11.6.5.2
f5	big-ip link controller	11.6.1 – < 11.6.5.2
f5	big-ip local traffic manager	11.6.1 – < 11.6.5.2
f5	big-ip policy enforcement manager	11.6.1 – < 11.6.5.2
f5	ssl orchestrator	11.6.1 – < 11.6.5.2
—	BIG-IP	15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1

Referenzen und Patches

https://support.f5.com/csp/article/K52145254 Vendor Advisory
http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
VU#290915 third-party-advisoryThird Party AdvisoryUS Government Resource
https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/ ExploitThird Party Advisory
https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html Third Party AdvisoryVDB Entry
https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902 Broken LinkExploitThird Party Advisory
http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html ExploitThird Party AdvisoryVDB Entry
https://swarm.ptsecurity.com/rce-in-f5-big-ip/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/175671/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5902 US Government Resource

CPE-Treffer (NVD) (60)

cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 ≤ 15.0.1.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 < 11.6.5.2
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 < 12.1.5.2
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 < 13.1.3.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.2.6
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.4

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch
nvd	CVSS 2.0	10.0Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

100.00%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2020-01-06
Veröffentlicht2020-07-01 03:00
Bei IP-DB eingegangen2026-10-24 23:34
In KEV aufgenommen2021-11-03
Zuletzt aktualisiert2026-06-17 06:22

Vergeben von (CNA): f5
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — F5 BIG-IP

9.8Kritisch

CVE-2026-94127 KEV vor 1 Monat

BIG-IP APM OAuth vulnerability

F5 BIG-IP

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

27%EPSS

3.1Niedrig

CVE-2026-63020 vor 2 Monaten

BIG-IP Configuration utility vulnerability

F5 BIG-IP

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message …

8.8Hoch

CVE-2026-66842 vor 2 Monaten

BIG-IP and BIG-IQ Configuration utility vulnerability

F5 BIG-IP; F5 BIG-IQ

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attack…

7.5Hoch

CVE-2026-59762 vor 3 Monaten

BIG-IP HTTP/2 vulnerability

F5 BIG-IP; F5 BIG-IP Next for Kubernetes; F5 BIG-IP Next SPK; F5 BIG-IP Next CNF

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. …

7.5Hoch

CVE-2026-40423 vor 5 Monaten

BIG-IP SIP profile vulnerability

F5 BIG-IP

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.8Mittel

CVE-2026-24464 vor 5 Monaten

Appliance mode iControl REST vulnerability

F5 BIG-IP

When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software vers…