CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP

A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and obtain remote code execution as the “root” user on the target system.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Valid user credentials
• The capability to send requests to the iControl REST component and/or the capability to execute tmsh commands

Proof Of Concept:

More details and the exploitation process can be found in this PDF.