CVE-2025-61958: BIG-IP TMSH vulnerability
A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
A vulnerability exists in the iHealth utility of the TMOS Shell (tmsh) that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to the Advanced Shell (bash). For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.117.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.10.8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61958?
CVE-2025-61958 is classified as a medium-severity vulnerability due to its potential to allow unauthorized access to critical system areas.
How do I fix CVE-2025-61958?
To mitigate CVE-2025-61958, upgrade to the latest patched version of F5 BIG-IP as specified in the product advisories.
Who is affected by CVE-2025-61958?
CVE-2025-61958 affects authenticated users with at least a resource administrator role on specific versions of F5 BIG-IP.
What systems are vulnerable to CVE-2025-61958?
F5 BIG-IP systems running in Appliance mode on specified versions from 15.1.0 to 17.5.1 are vulnerable to CVE-2025-61958.
What actions should be taken if CVE-2025-61958 is exploited?
If CVE-2025-61958 is exploited, immediate action should be taken to assess the system for unauthorized access and apply remediation using the latest patches.