A directory traversal vulnerability in an undisclosed iControl REST endpoint in Appliance mode may allow an authenticated administrator to bypass security boundaries and delete files.

A vulnerability in BIG-IP DNS's gtm_add and bigip_add iControl REST commands exposes the ssh-password parameter in cleartext within responses and audit logs, risking sensitive information disclosure to highly privileged attackers.

A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with at least the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.

A vulnerability in BIG-IP scripted monitors allows authenticated users with Resource Administrator or Administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in appliance mode.

An authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint in Appliance mode, potentially allowing an attacker to cross security boundaries.

An authenticated iControl SOAP user may be able to access or obtain information from other accounts, with versions past End of Technical Support not evaluated.

Configuring the BIG-IP Configuration utility to use LDAP authentication can cause the httpd process to exhaust available file descriptors due to undisclosed traffic, with unsupported software versions not evaluated.

Enabling a BIG-IP DNS profile with DNS cache on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with unsupported software versions not evaluated.

A vulnerability in iControl REST and TMOS Shell (tmsh) allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable execution of arbitrary commands.

Certain undisclosed requests can cause the bd process to terminate when a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, with unsupported software versions not evaluated.

A vulnerability in BIG-IP DNS allows authenticated Resource Administrator or Administrator users to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.

Configuring a BIG-IP APM access policy on a virtual server can cause the apmd process to terminate due to undisclosed traffic, with unsupported software versions not evaluated.

Configuring a SIP profile on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed traffic, with issues noted in software versions beyond End of Technical Support (EoTS).

IP-based access restrictions configured for httpd do not apply to all endpoints, potentially allowing connections from blocked IP addresses, except in versions that have reached End of Technical Support.

Incorrect permission assignment vulnerabilities in iControl REST and TMOS Shell (tmsh) undisclosed commands may allow authenticated attackers to access sensitive information.

Configuring an SSL profile on BIG-IP Virtual Edition without Intel QAT or on hardware with crypto.hwacceleration disabled can cause the Traffic Management Microkernel (TMM) to terminate when processing certain undisclosed traffic.

Configuring SSL profiles on a virtual server can cause the server to stop processing new client connections when handling undisclosed traffic, with versions beyond End of Technical Support not evaluated.

An authenticated attacker with Resource Administrator or Administrator roles can exploit iControl SOAP to modify configuration objects and escalate privileges, with unsupported software versions not evaluated.

A vulnerability in F5 BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with Resource Administrator role to create SNMP configuration objects via iControl REST or TMOS shell, resulting in privilege escalation.

A vulnerability in undisclosed pages of the Configuration utility may allow a low-privileged authenticated attacker to access sensitive information, with unsupported software versions not evaluated.

A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility, with versions that have reached End of Technical Support (EoTS) not evaluated.

A vulnerability in an undisclosed BIG-IP TMOS Shell command allows authenticated users with resource administrator or administrator roles to execute arbitrary system commands with elevated privileges, potentially crossing security boundaries in Appliance mode.

Configuring BIG-IP PEM iRules with certain commands on a virtual server can cause the Traffic Management Microkernel (TMM) to terminate, with unsupported software versions not evaluated.

An improper sanitization vulnerability in the BIG-IP QKView utility allows low-privileged attackers to read sensitive information from QKView files, with unsupported software versions not evaluated.

A vulnerability in iControl REST allows a highly privileged, authenticated attacker with at least Manager role to create configuration objects that enable arbitrary command execution.

Certain undisclosed traffic on an HTTP/2 virtual server with Layer 7 DoS Protection can increase memory usage and cause the Traffic Management Microkernel (TMM) process to terminate.

A vulnerability in BIG-IP systems enables a highly privileged, authenticated attacker with at least Resource Administrator role to modify configuration objects, resulting in privilege escalation.

A sensitive information disclosure vulnerability in an undisclosed iControl REST endpoint and TMOS Shell (tmsh) command may allow an authenticated attacker with resource administrator privileges to access sensitive information.

Configuring a classification profile on a UDP virtual server can cause the Traffic Management Microkernel (TMM) to terminate upon receiving certain undisclosed requests, with unsupported software versions not evaluated.

An authenticated remote code execution vulnerability exists in the BIG-IP and BIG-IQ Configuration utility through undisclosed vectors, excluding software versions that have reached End of Technical Support.

Incorrect permission assignment vulnerabilities in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and BIG-IP iControl REST may allow authenticated attackers to view network status of destination systems.

An authenticated attacker can exploit undisclosed requests to BIG-IP iControl REST to leak local user account names, with unsupported software versions not evaluated.

A vulnerability in iControl SOAP allows authenticated users with Resource Administrator or Administrator roles to download sensitive files, with unsupported software versions not evaluated.

A vulnerability in BIG-IP and BIG-IQ systems allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects and execute arbitrary commands, excluding versions past End of Technical Support.

A vulnerability in an undisclosed TMOS Shell (tmsh) command in BIG-IP DNS may allow a highly privileged authenticated attacker to view sensitive information.

Configuring an HTTP/2 profile with an iRule using HTTP::redirect or HTTP::respond on a virtual server can cause the Traffic Management Microkernel (TMM) process to terminate due to certain request handling issues.

A directory traversal vulnerability in BIG-IP SSL Orchestrator allows an authenticated high-privilege attacker to overwrite, delete, or corrupt arbitrary local files, affecting supported software versions.