CVE-2025-59481: BIG-IP iControl REST and tmsh vulnerability
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least the resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.317.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.10.8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59481?
The severity of CVE-2025-59481 is critical due to its potential to allow authenticated attackers to execute arbitrary system commands with elevated privileges.
How do I fix CVE-2025-59481?
To fix CVE-2025-59481, update your F5 BIG-IP to the patched version specified in the advisory that addresses this vulnerability.
Which versions of F5 BIG-IP are affected by CVE-2025-59481?
F5 BIG-IP versions 17.5.0 to 17.5.1.317.1.3, 16.1.0 to 16.1.6.1, and 15.1.0 to 15.1.10.8 are affected by CVE-2025-59481.
What are the potential impacts of exploiting CVE-2025-59481?
Exploiting CVE-2025-59481 may allow attackers to gain unauthorized control over the affected system and compromise sensitive data.
Who can exploit CVE-2025-59481?
CVE-2025-59481 can be exploited by authenticated users with at least the resource administrator role.