CVE-2020-5902
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
Description
CVE-2020-5902 is a CRITICAL remote code execution vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI), carrying a CVSS 3.1 score of 9.8. The vulnerability exists in undisclosed pages of the TMUI, also known as the Configuration utility, allowing unauthenticated remote attackers to execute arbitrary system commands, read or write files, and disable services on vulnerable BIG-IP devices. Affected products include F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 across all BIG-IP modules including Access Policy Manager, Advanced Firewall Manager, Application Security Manager, Local Traffic Manager, and others. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.94426 (99.98th percentile), this vulnerability demonstrates the highest levels of real-world exploitation activity and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, <= 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip advanced firewall manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip advanced web application firewall | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip analytics | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip application acceleration manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip application security manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip ddos hybrid defender | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip domain name system | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip fraud protection service | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip global traffic manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip link controller | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip local traffic manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | big-ip policy enforcement manager | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
| f5 | ssl orchestrator | >= 11.6.1, < 11.6.5.2; >= 12.1.0, < 12.1.5.2; >= 13.1.0, < 13.1.3.4; >= 14.1.0, < 14.1.2.6; >= 15.0.0, < 15.0.1.4; >= 15.1.0, < 15.1.0.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/175671/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/(Exploit, Third Party Advisory)
- https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902(Broken Link, Exploit, Third Party Advisory)
- https://support.f5.com/csp/article/K52145254(Vendor Advisory)
- https://swarm.ptsecurity.com/rce-in-f5-big-ip/(Exploit, Third Party Advisory)
- https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/(Exploit, Third Party Advisory)
- https://www.kb.cert.org/vuls/id/290915(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5902(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-5902 is classified under CWE-22 — Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal. This weakness occurs when software uses external input to construct a pathname intended to identify a file or directory within a restricted parent directory, but fails to properly neutralize special elements such as ".." sequences. Attackers can use these sequences to escape the intended directory and access files or directories elsewhere on the system, potentially reading sensitive files, overwriting critical data, or executing arbitrary code.
In the context of F5 BIG-IP TMUI, this path traversal flaw is particularly devastating because the management interface operates with elevated system privileges. By crafting specially formed HTTP requests containing directory traversal sequences, attackers can bypass authentication controls entirely and interact with sensitive system endpoints. This enables full remote code execution on the underlying BIG-IP system, which typically sits at a critical network chokepoint handling application traffic, SSL termination, and access control decisions.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2020-5902 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants attackers complete read access to the BIG-IP file system, including configuration files containing sensitive information such as SSL certificates, private keys, LDAP credentials, and network topology details. The TMUI runs with root-level privileges, enabling access to all data on the device.
Integrity (HIGH): Attackers can modify system configurations, create or delete files, plant backdoors, and alter traffic handling rules. Given BIG-IP's role as a network gateway, this could enable traffic interception, credential harvesting, or redirection of application traffic to malicious endpoints.
Availability (HIGH): Complete disruption of BIG-IP services is possible, including disabling critical network functions such as load balancing, SSL offloading, and application delivery. Attackers can disable services, crash the system, or render the device inoperable, causing widespread network outages.
With an EPSS score of 0.94426 (99.98th percentile), this vulnerability ranks among the most exploited vulnerabilities ever tracked, reflecting its trivial exploitability and high-value target profile.
Exploit Maturity
CVE-2020-5902 has extensive confirmed exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been massively exploited since its disclosure in July 2020. Multiple public exploit codes and automated scanning tools are readily available. Within days of disclosure, thousands of vulnerable BIG-IP instances were identified on the internet, and active exploitation campaigns were observed by multiple security organizations. The EPSS score of 0.94426 (99.98th percentile) reflects near-universal exploitation.
Ransomware association: CVE-2020-5902 has been confirmed as associated with ransomware campaigns. Multiple ransomware operators have incorporated this vulnerability into their attack chains to gain initial access to enterprise networks through compromised BIG-IP devices.
Attack surface: Public proof-of-concept exploits were published within hours of disclosure. Over 3,000 vulnerable BIG-IP instances were initially identified as internet-exposed. Nation-state actors, ransomware groups, and opportunistic attackers have all leveraged this vulnerability extensively.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Given the trivial exploitation complexity and widespread active attacks, all organizations should have remediated this vulnerability immediately upon patch availability.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the F5 security advisory at support.f5.com/csp/article/K52145254 for version-specific patch guidance. Update to BIG-IP 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, or 11.6.5.2 or later.
- Restrict TMUI access immediately. If patching cannot be performed instantly, restrict access to the TMUI (Configuration utility) by limiting it to trusted management networks only. Block all public internet access to the management interface on ports 443 and 22.
- Verify affected product versions across your environment. Identify all BIG-IP instances across all modules including Access Policy Manager, Advanced Firewall Manager, Application Security Manager, Local Traffic Manager, and others. Use network scanning to discover any previously unknown BIG-IP deployments.
- Scan for indicators of prior compromise. Given the massive exploitation of this vulnerability, conduct thorough forensic analysis of all BIG-IP devices. Check for unauthorized files, modified configurations, suspicious cron jobs, and unexpected network connections. Review TMUI access logs for exploitation attempts.
- Implement network segmentation for management interfaces. Ensure all BIG-IP management interfaces are isolated on dedicated management VLANs with strict access controls. Never expose TMUI to the public internet.
- Update detection and monitoring capabilities. Deploy IDS/IPS signatures and WAF rules to detect CVE-2020-5902 exploitation attempts. Monitor BIG-IP devices for anomalous behavior, unexpected configuration changes, and unauthorized access patterns.
Technical Details
CVE-2020-5902 is a CRITICAL-severity vulnerability in F5 BIG-IP TMUI that can be exploited remotely over the network. The attack complexity is low, requiring no specialized conditions or preparation. No authentication or privileges are required, and no user interaction is needed — making this a fully unauthenticated remote code execution vulnerability.
Technical mechanism: The vulnerability resides in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, which runs on Apache httpd with custom URL handling. A path traversal flaw in the URL normalization logic allows attackers to bypass access controls by inserting directory traversal sequences into HTTP requests. Specifically, semicolons and other special characters in request URIs can confuse the access control mechanism, enabling requests to reach backend servlets and scripts that should be restricted to authenticated administrators. This allows unauthenticated attackers to execute arbitrary commands with root privileges via the underlying Bash shell.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network-based attack vector, low complexity, no privileges required, no user interaction needed, and maximum impact across all three CIA dimensions. The Unchanged scope means impact is contained within the BIG-IP system itself, though the strategic positioning of BIG-IP devices means compromise has cascading effects on all services behind the device.
Affected versions: BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 across all BIG-IP product modules.
Frequently Asked Questions
Is CVE-2020-5902 being actively exploited?
Yes, CVE-2020-5902 has been massively exploited since its disclosure in July 2020. It is listed in CISA's Known Exploited Vulnerabilities catalog and has an EPSS score of 0.94426 (99.98th percentile), confirming near-universal exploitation. Multiple public exploits exist and the vulnerability has been used by nation-state actors, ransomware operators, and opportunistic attackers.
What products are affected by CVE-2020-5902?
All F5 BIG-IP modules are affected, including Access Policy Manager, Advanced Firewall Manager, Application Security Manager, Local Traffic Manager, Domain Name System, Analytics, and others. Affected versions span BIG-IP 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1.
How do I fix CVE-2020-5902?
Update to BIG-IP versions 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, or 11.6.5.2 or later. Immediately restrict TMUI access to trusted management networks only. Consult the F5 security advisory K52145254 for detailed remediation guidance. After patching, perform forensic analysis to check for prior compromise.
How severe is CVE-2020-5902?
CVE-2020-5902 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows fully unauthenticated remote code execution with no user interaction required. Its EPSS score of 0.94426 (99.98th percentile) places it among the most exploited vulnerabilities ever tracked. It has confirmed ransomware associations and has been used extensively by advanced threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.