📌 Overview

Disclosed by F5 on June 30, 2020 (NVD published July 1, 2020), this flaw allowed unauthenticated attackers (or authenticated users) with network access to the management interface to execute arbitrary system commands, read/write/delete files, disable services, run arbitrary Java code, and achieve full root-level system compromise.

Exploitation started within hours of disclosure — cryptominers, backdoors, credential theft, and lateral movement were observed in the wild almost immediately.
CISA added it to their Known Exploited Vulnerabilities catalog and warned that any internet-exposed unpatched device was very likely already compromised.

🧨 Impact

• 🌍 Network-exploitable (no authentication in default exposed setups)
• 🔓 Unauthenticated in most real-world attacks
• ⚡ Low attack complexity — single crafted HTTP request
• 💥 Full system takeover (root access on the appliance)
• 📈 CVSS v3.1: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Massive blast radius: BIG-IP devices are load balancers / ADC / firewalls in critical infrastructure, often internet-facing or in DMZ.

F5 themselves stated high confidence that remaining unpatched internet-exposed systems were already owned.

📸 illustrative images

📦 Affected Versions

Vulnerable ranges (before July 2020 patches):

BIG-IP 15.0.0 – 15.1.0.3
BIG-IP 14.1.0 – 14.1.2.5
BIG-IP 13.1.0 – 13.1.3.3
BIG-IP 12.1.0 – 12.1.5.1
BIG-IP 11.6.1 – 11.6.5.1

Affected modules: TMUI / Configuration utility (ports 443/8443 typically).

🔎 Technical Root Cause

• Directory traversal + path traversal via ..;/ sequences in TMUI JSP pages
• Parser mismatch between frontend (Apache) → backend (Tomcat/Java)
• Unsafe invocation of tmsh commands and file operations from unauthenticated paths
• Allowed bypass of auth → direct access to admin functions (e.g. tmshCmd.jsp, fileRead.jsp)

Classic "breaking the parser chain" leading to unauthenticated RCE.

🛠 Remediation

✅ Immediate Actions (even in 2026)

• Upgrade to a modern, supported BIG-IP version (all branches post-2020 include the fix — check F5 support matrix)
• If patching delayed (historical only):
  • Block public access to management ports (443/8443)
  • Use iRules / AFM to drop requests with ..;/tmui/ patterns
  • Disable TMUI if not needed
• Assume breach if the device was internet-facing and unpatched anytime in 2020–2021: full IR, credential rotation, forensic analysis.

🧪 Detection Tips

Search logs / network traffic for:

• Requests containing /tmui/login.jsp/..;/ or similar traversal
• Endpoints like tmshCmd.jsp, fileRead.jsp, fileSave.jsp
• Unusual tmsh commands or file operations
• 200/500 responses with unexpected content after suspicious paths

Zeek / Suricata rules and Metasploit module existed within days.

📚 Summary Table

⚠️ Final Note (March 2026)

This is now a ~6-year-old vulnerability.
Any properly maintained F5 BIG-IP should have been patched long ago.
However, forgotten / legacy / unmaintained internet-exposed appliances remain a realistic risk — treat any such discovery as immediate compromise indicator.

Official sources:

• F5 K52145254 → https://support.f5.com/csp/article/K52145254
• NVD → https://nvd.nist.gov/vuln/detail/CVE-2020-5902
• CISA AA20-206A → https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-206a

Patch everything. Segment management interfaces. Stay safe. 🛡️