{"metadata": {"vulnerability": "CVE-2025-31644", "count": 41, "kinds": {"milestone": 8, "sighting": 14, "kev": 0, "other": 19}}, "data": [{"timestamp": "2025-02-25T15:15:00Z", "date_only": false, "value": "2025-02-25T15:15:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0147", "record": "NCSC-2025-0147", "field": "document.tracking.generator.date"}, {"timestamp": "2025-04-23T22:28:44.369Z", "date_only": false, "value": "2025-04-23T22:28:44.369Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-31644", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-07T00:00:00Z", "date_only": true, "value": "2025-05-07", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0382", "record": "CERTFR-2025-AVI-0382", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-05-07T14:00:00Z", "date_only": false, "value": "2025-05-07T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / f5", "record": "CVE-2025-31644", "field": "containers.cna.datePublic"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-07T22:00:00Z", "date_only": false, "value": "2025-05-07T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-05-07T22:04:10.938Z", "date_only": false, "value": "2025-05-07T22:04:10.938Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-31644", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-07T22:04:10.938Z", "date_only": false, "value": "2025-05-07T22:04:10.938Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / f5", "record": "CVE-2025-31644", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-07T22:15:18Z", "date_only": false, "value": "2025-05-07T22:15:18Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2MQ5-VGX2-CQ4H", "record": "GHSA-2MQ5-VGX2-CQ4H", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-07T22:15:18.567Z", "date_only": false, "value": "2025-05-07T22:15:18.567", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31644", "record": "FKIE_CVE-2025-31644", "field": "published"}, {"timestamp": "2025-05-07T22:23:00Z", "date_only": false, "value": "2025-05-07T22:23:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15443", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "dcb893db-ac8c-468f-967a-0f272ce05e51", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-31644\n\ud83d\udd25 CVSS Score: 8.7 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\ud83d\udccf Published: 2025-05-07T22:04:10.938Z\n\ud83d\udccf Modified: 2025-05-07T22:04:10.938Z\n\ud83d\udd17 References:\n1. https://my.f5.com/manage/s/article/K000148591", "url": "https://t.me/DarkWebInformer_CVEAlerts/15443"}, {"timestamp": "2025-05-07T23:30:25.967Z", "date_only": false, "value": "2025-05-07T23:30:25.967919Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lomkcxrvqak2", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "c542b4af-a7cf-40c9-a582-180d2a845e87", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lomkcxrvqak2"}, {"timestamp": "2025-05-08T00:26:17.071Z", "date_only": false, "value": "2025-05-08T00:26:17.071375Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lomnmxb6mz2l", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "dea4d969-0ca6-4298-b3eb-cb61ebf695f4", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lomnmxb6mz2l"}, {"timestamp": "2025-05-08T00:31:11Z", "date_only": false, "value": "2025-05-08T00:31:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2MQ5-VGX2-CQ4H", "record": "GHSA-2MQ5-VGX2-CQ4H", "field": "published"}, {"timestamp": "2025-05-08T00:31:11Z", "date_only": false, "value": "2025-05-08T00:31:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2MQ5-VGX2-CQ4H", "record": "GHSA-2MQ5-VGX2-CQ4H", "field": "modified"}, {"timestamp": "2025-05-08T00:52:51Z", "date_only": false, "value": "2025-05-08T00:52:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/24776", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "7ae0b676-0534-4473-b4c0-99a0b7031d40", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-31644 - F5 BIG-IP Command Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-31644 \nPublished : May 7, 2025, 10:15 p.m. | 29\u00a0minutes ago \nDescription : When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. \nSeverity: 8.7 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/24776"}, {"timestamp": "2025-05-08T01:31:12.957Z", "date_only": false, "value": "2025-05-08T01:31:12.957467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redteamnews.bsky.social/post/3lomrb2mw5p2h", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "112635b6-bcde-4db9-aaaa-bf6778746197", "url": "https://bsky.app/profile/redteamnews.bsky.social/post/3lomrb2mw5p2h"}, {"timestamp": "2025-05-09T00:00:00Z", "date_only": false, "value": "2025-05-09T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0382", "record": "CERTFR-2025-AVI-0382", "field": "last_revision_date"}, {"timestamp": "2025-05-09T00:00:00Z", "date_only": false, "value": "2025-05-09T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0382", "record": "CERTFR-2025-AVI-0382", "field": "initial_release_date"}, {"timestamp": "2025-05-09T00:00:00Z", "date_only": false, "value": "2025-05-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0382", "record": "CERTFR-2025-AVI-0382", "field": "revisions.0.revision_date"}, {"timestamp": "2025-05-09T08:07:32.002Z", "date_only": false, "value": "2025-05-09T08:07:32.002935Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0147", "record": "NCSC-2025-0147", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-09T08:07:32.002Z", "date_only": false, "value": "2025-05-09T08:07:32.002935Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0147", "record": "NCSC-2025-0147", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-05-09T08:07:32.002Z", "date_only": false, "value": "2025-05-09T08:07:32.002935Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0147", "record": "NCSC-2025-0147", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-11T08:34:39Z", "date_only": false, "value": "2025-05-11T08:34:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/36371", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "4dd9991e-e093-42d0-a3a6-9c38c5fa6ee3", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP\nURL\uff1ahttps://github.com/mbadanoiu/CVE-2025-31644\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/36371"}, {"timestamp": "2025-05-12T22:00:00Z", "date_only": false, "value": "2025-05-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-05-12T22:00:00Z", "date_only": false, "value": "2025-05-12T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-05-13T06:56:00.036Z", "date_only": false, "value": "2025-05-13T06:56:00.036+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-0985", "record": "WID-SEC-W-2025-0985", "field": "document.tracking.generator.date"}, {"timestamp": "2025-05-14T18:38:05Z", "date_only": false, "value": "2025-05-14T18:38:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cybersecplayground/204", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "e1e996bb-e911-42a6-99b7-7ff1f48d4825", "content": "\ud83d\udea8 CVE-2025-31644: Command Injection in F5 BIG-IP (Appliance Mode) \ud83d\udea8\n\nA critical vulnerability has been discovered in F5 BIG-IP systems running in Appliance Mode via iControl REST and tmsh, allowing unauthenticated attackers to execute commands as root.\n\n\ud83d\udca5 This flaw leverages CWE-78: OS Command Injection. An attacker can chain this with management interface exposure to gain full control.\n\n\ud83d\udd25 Proof of Concept\n\ud83d\udc49 GitHub PoC\n\n\ud83d\udd0d Detection Queries\nHUNTER: product.name=\"F5 BIG-IP\"\nFOFA: product=\"f5-BIGIP\"\nShodan: title:\"Big-IP®-Redirect\" or http.favicon.hash:-335242539\n\n\n\ud83d\udcf0 References:\nF5 Official Advisory\nSecurityOnline Info\nCWE-78 Overview\n\n\ud83d\udd10 Mitigation:\n\ud83d\udc49\ud83c\udffb Disable Appliance Mode where not needed\n\ud83d\udc49\ud83c\udffb Restrict access to management interfaces\n\ud83d\udc49\ud83c\udffb Apply official patches ASAP\n\n\u26a1\ufe0f Join us for daily threat updates, CVEs, PoCs, and hunting tools \ud83d\udc47\n\ud83d\udcf2 @cybersecplayground\n\n\ud83d\udc4d Dont Forget to Like | \ud83d\udd01 Share | \ud83d\udce1 Hunt smart!\n\n#hunterhow  #infosec  #infosecurity  #OSINT  #Vulnerability  #bugbountytips  #F5  #BIGIP  #CVE2025_31644", "url": "https://t.me/cybersecplayground/204"}, {"timestamp": "2025-05-15T04:01:16.370Z", "date_only": false, "value": "2025-05-15T04:01:16.370657Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-31644", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-15T04:01:16.370Z", "date_only": false, "value": "2025-05-15T04:01:16.370657Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31644", "record": "FKIE_CVE-2025-31644", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-08-03T21:02:45.730Z", "date_only": false, "value": "2025-08-03T21:02:45.730317Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvjlbvtnra22", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "d7f72fef-8263-4be7-be35-ecdfd75ecfc4", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvjlbvtnra22"}, {"timestamp": "2026-02-26T18:28:43.015Z", "date_only": false, "value": "2026-02-26T18:28:43.015Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-31644", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-26T18:28:43.015Z", "date_only": false, "value": "2026-02-26T18:28:43.015Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-31644", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T09:10:43.400Z", "date_only": false, "value": "2026-06-17T09:10:43.400", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-31644", "record": "FKIE_CVE-2025-31644", "field": "lastModified"}, {"timestamp": "2026-07-20T21:00:06.680Z", "date_only": false, "value": "2026-07-20T21:00:06.680367Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/1041", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "0145a2e9-b692-415e-b00e-eb6e33ef1524", "url": "https://t.me/crackvaultde/1041"}, {"timestamp": "2026-07-21T00:00:18.447Z", "date_only": false, "value": "2026-07-21T00:00:18.447944Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/crackvaultde/1041", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "613cc2e8-7abf-4128-8892-a6e411e1e9b9", "url": "https://t.me/crackvaultde/1041"}, {"timestamp": "2026-07-22T00:00:33.702Z", "date_only": false, "value": "2026-07-22T00:00:33.702795Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/crackvaultde/1041", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "a68ccf15-ca57-4b32-95f2-39076389c20b", "url": "https://t.me/crackvaultde/1041"}, {"timestamp": "2026-07-26T02:00:12.803Z", "date_only": false, "value": "2026-07-26T02:00:12.803606Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/814", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "88f68b63-053e-4ba2-9ad7-af804a1b9b86", "url": "https://t.me/cyberwarehouse/814"}, {"timestamp": "2026-07-27T00:00:29.837Z", "date_only": false, "value": "2026-07-27T00:00:29.837691Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/814", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "2231ed79-e3c9-4a1d-9381-ad29a87a1416", "url": "https://t.me/cyberwarehouse/814"}, {"timestamp": "2026-08-14T16:00:12.876Z", "date_only": false, "value": "2026-08-14T16:00:12.876902Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/634", "record": "CVE-2025-31644", "field": "creation_timestamp", "uuid": "8bb9917a-f7b6-46c9-8d3c-33bd0e97bf92", "url": "https://t.me/purp_sec/634"}]}