CVE-2025-31644 (GCVE-0-2025-31644)

Vulnerability from cvelistv5 – Published: 2025-05-07 22:04 – Updated: 2026-02-26 18:28
VLAI
Title
Appliance mode BIG-IP iControl REST and tmsh vulnerability
Summary
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
8.5 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-15 04:01 UTC
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
f5 CNA under the mitre root
CNA scorecard B 84/100 over 87 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
F5 BIG-IP Unaffected: 17.5.0 , < * (custom)
Affected: 17.1.0 , < 17.1.2.2 (custom)
Affected: 16.1.0 , < 16.1.6 (custom)
Affected: 15.1.0 , < 15.1.10.7 (custom)
guessed Create a notification for this product.
Date Public
2025-05-07 14:00
Credits
F5 acknowledges Matei "Mal" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31644",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:01:16.370657Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:43.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "All Modules",
            "Appliance Mode"
          ],
          "product": "BIG-IP",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "17.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.1.2.2",
              "status": "affected",
              "version": "17.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "16.1.6",
              "status": "affected",
              "version": "16.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1.10.7",
              "status": "affected",
              "version": "15.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5 acknowledges Matei \"Mal\" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2025-05-07T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (\u003c/span\u003e\u003cstrong\u003etmsh\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u003c/span\u003e\u0026nbsp;\u0026nbsp;Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-07T22:04:10.938Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000148591"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Appliance mode BIG-IP iControl REST and tmsh vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2025-31644",
    "datePublished": "2025-05-07T22:04:10.938Z",
    "dateReserved": "2025-04-23T22:28:44.369Z",
    "dateUpdated": "2026-02-26T18:28:43.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-31644",
      "date": "2026-10-29",
      "epss": "0.24304",
      "percentile": "0.97859"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "modules": [
                  "All Modules",
                  "Appliance Mode"
                ],
                "product": "BIG-IP",
                "vendor": "F5",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "17.5.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "17.1.2.2",
                    "status": "affected",
                    "version": "17.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "16.1.6",
                    "status": "affected",
                    "version": "16.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "15.1.10.7",
                    "status": "affected",
                    "version": "15.1.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "f5sirt@f5.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "90F95346-79C4-47DF-B32F-E271483B15DD",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A20AA9F1-12A2-41BC-907A-E3BCFA7EA3CE",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0A32A8D1-51DA-4809-A40E-485D1A3165BD",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76F07A61-62B9-479B-9292-CE2D381CF8BA",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EF26442-8624-4BAE-9BA0-6261A48ECA3E",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5758E02E-B667-4C28-8470-422CD6B0B85E",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "666ADDDB-A0C1-4647-B5BA-0352B6259EB0",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AEEBBE61-4525-414C-9425-1B2FB25FF9A4",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D713946-31BB-40EC-8E65-7FC41B95A676",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6DC3F0E-043C-4F2F-9E86-47B9AFFF27EF",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF9A7584-3423-4A3F-B95B-8186DD0E0376",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "30D804D3-B5AA-49F8-A41C-636CB1C6C408",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "56DD991A-A748-4AAF-B611-AA3530C8E577",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F5FBC1A-FDFB-4056-9D31-8156CF159643",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E08457C8-FC30-4C7B-8CB3-034DEFE1BD96",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E23F45D6-F85C-482E-B202-07582E625189",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C8603239-5BAB-4B68-A9AD-7B91B3493F1E",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "12B753F7-FC67-4FBA-A903-7F475804577D",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A98F9CC-8D1D-47AC-812B-45C6174D8493",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C33F8DDF-1238-4079-A770-EDFBCF42F5F3",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AC902698-630D-4ECC-AE88-3D2017C79072",
                    "versionEndExcluding": "15.1.10.7",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "304BAC5F-38E2-4629-A4B5-43F2F1AB9CB9",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "859A0BFC-CD50-4482-967F-5816F8480B8F",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FB936160-C10D-4556-B5AF-C1BA12C38673",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9C7A2C91-A997-4F82-A5C3-5F9943B1B6FC",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4E80DD1F-0A18-4536-B501-7B1740A49C68",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7B760A6-59A8-46E1-9CA1-23FA27982705",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B105CC45-1A86-435D-A56F-AD664DA50F50",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8CF5250B-484E-45CC-89B4-9459300DC6AE",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "050656BF-3203-4C95-BF15-C3D1A1A494DD",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3891240B-CB4D-4E2B-AE63-6BF22F3F4B4B",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6CDB335-7BA3-4BC8-B47A-CC46C5922449",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7BE02E41-858F-4A18-9878-B9EA7D760470",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7215503-77B5-4D6B-8AB8-950B74A53AC6",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C191C32D-0788-4405-B484-331260ADDAD1",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5A7AF326-9537-480E-B9AF-E217638D7239",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "24009DF3-E5AE-42C8-8452-64839C4ED1E5",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7CA0D19-0DB0-4EEE-95D6-21E71E1583DB",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "39889DFE-E0C9-46B6-B4FD-EEB38AB3A2A4",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "ECD0333F-74B6-4438-BE6B-7B35304F8065",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "74D5E3BC-68DB-4190-80AC-526F788483C9",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AC9024C0-1CD3-4D21-B57E-953525E37A22",
                    "versionEndExcluding": "16.1.6",
                    "versionStartIncluding": "16.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82CB65BA-537C-4D9B-B13B-2BDD09F341F3",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19319242-7A85-4FFF-AD8F-08BEE84CA86F",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7C2E4A77-3825-4678-8E35-466E5C799ECF",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "369E542B-7A37-4C8F-9B84-1A01237915AC",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "735CE14F-E69F-4EBE-B5CC-20A7465A92FD",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6F118E82-BDA3-4DB6-8133-F5D9919CDAF3",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "855D5E18-2BD4-47FB-AD46-688159A254C5",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BAD38915-4D18-47C4-B217-43B966F21676",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AD47B7A9-34D7-4853-9DF3-7CB3ABCC4033",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8DCDFCD9-CB18-449D-8DC3-1F6FD9DE977F",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "471B3260-70CD-4A9D-9017-C3DD311BB86E",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "078F13E4-20AC-45A1-9759-67450F1E0FC0",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "322D2910-E25D-408B-B72E-2796D597340D",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9BEAA3B-59FD-4FDC-9039-542D19B26648",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE4DC393-D404-4F6C-B551-759558510719",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75492B9E-FC4D-47CD-8523-DA0103956C72",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "038EC267-7992-4A9B-8A25-DABB152C51B8",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E93A5C2-5E03-4D09-BA51-EC353CBCDCCC",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "31882F94-D9C4-43F1-ACEE-57AD042459DA",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B182998B-1A34-4339-966B-16341DE9D752",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5CB7038-304C-4332-B079-7C23FC73BD20",
                    "versionEndExcluding": "17.1.2.2",
                    "versionStartIncluding": "17.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
          },
          {
            "lang": "es",
            "value": "Al ejecutarse en modo Appliance, existe una vulnerabilidad de inyecci\u00f3n de comandos en un comando no revelado de iControl REST y BIG-IP TMOS Shell (tmsh), que podr\u00eda permitir que un atacante autenticado con privilegios de administrador ejecute comandos arbitrarios del sistema. Una explotaci\u00f3n exitosa puede permitir al atacante traspasar una barrera de seguridad. Nota: Las versiones de software que han alcanzado el fin del soporte t\u00e9cnico (EoTS) no se eval\u00faan."
          }
        ],
        "id": "CVE-2025-31644",
        "lastModified": "2026-06-17T09:10:43.400",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 5.8,
              "source": "f5sirt@f5.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "f5sirt@f5.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-31644",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:01:16.370657Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-05-07T22:15:18.567",
        "references": [
          {
            "source": "f5sirt@f5.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://my.f5.com/manage/s/article/K000148591"
          }
        ],
        "sourceIdentifier": "f5sirt@f5.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-77"
              }
            ],
            "source": "f5sirt@f5.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:45:28+00:00",
      "cve": "CVE-2025-31644",
      "id": "CVE-2025-31644",
      "initial_release_date": "2025-05-07T14:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Appliance mode BIG-IP iControl REST and tmsh vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31644.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-31644",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-05-08T03:56:05.891822Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-05-08T12:59:16.158Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "modules": [
                "All Modules",
                "Appliance Mode"
              ],
              "product": "BIG-IP",
              "vendor": "F5",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "17.5.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "17.1.2.2",
                  "status": "affected",
                  "version": "17.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "16.1.6",
                  "status": "affected",
                  "version": "16.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "15.1.10.7",
                  "status": "affected",
                  "version": "15.1.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "F5 acknowledges Matei \"Mal\" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure."
            }
          ],
          "datePublic": "2025-05-07T14:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (\u003c/span\u003e\u003cstrong\u003etmsh\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u003c/span\u003e\u0026nbsp;\u0026nbsp;Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
                }
              ],
              "value": "When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-77",
                  "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-07T22:04:10.938Z",
            "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
            "shortName": "f5"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://my.f5.com/manage/s/article/K000148591"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Appliance mode BIG-IP iControl REST and tmsh vulnerability",
          "x_generator": {
            "engine": "F5 SIRTBot v1.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "assignerShortName": "f5",
        "cveId": "CVE-2025-31644",
        "datePublished": "2025-05-07T22:04:10.938Z",
        "dateReserved": "2025-04-23T22:28:44.369Z",
        "dateUpdated": "2025-05-15T04:01:14.897Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.