Cyber Posture

CVE-2025-20029

HighRCE

Published: 05 February 2025

Published
05 February 2025
Modified
21 October 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6618 98.5th percentile
Risk Priority 57 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20029 is a high-severity OS Command Injection (CWE-78) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the command injection vulnerability by requiring timely identification, reporting, and patching of the specific flaw in iControl REST and tmsh save command as per the F5 advisory.

SI-10 Information Input Validation good match
prevent

Prevents command injection (CWE-78) by enforcing input validation mechanisms at the iControl REST and tmsh interfaces to reject malformed or malicious inputs.

AC-6 Least Privilege partial match
prevent

Limits the impact of arbitrary command execution by ensuring authenticated low-privilege users and affected processes operate with least privilege on the BIG-IP system.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection in public iControl REST/tmsh interface directly enables remote arbitrary command execution (T1190 + T1059.004) from low-privileged auth, resulting in full system compromise (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Deeper analysisAI

CVE-2025-20029 is a command injection vulnerability (CWE-78) present in the iControl REST interface and the BIG-IP TMOS Shell (tmsh) save command of F5 BIG-IP systems. Published on 2025-02-05, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact. Software versions that have reached End of Technical Support (EoTS) are not evaluated for this issue.

An authenticated attacker with low privileges (PR:L) can exploit the vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation enables the execution of arbitrary system commands on the affected BIG-IP system, granting high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H).

Mitigation details, including available patches, are outlined in the F5 security advisory at https://my.f5.com/manage/s/article/K000148587.

Details

CWE(s)
CWE-78

Affected Products

f5
big-ip access policy manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip advanced firewall manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip advanced web application firewall
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip analytics
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip application acceleration manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip application security manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip application visibility and reporting
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip automation toolchain
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip carrier-grade nat
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
f5
big-ip container ingress services
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2.1
+11 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-20058Same product: F5 Big-Ip Access Policy Manager
CVE-2025-21091Same product: F5 Big-Ip Access Policy Manager
CVE-2025-20045Same product: F5 Big-Ip Access Policy Manager
CVE-2025-24320Same product: F5 Big-Ip Access Policy Manager
CVE-2025-21087Same product: F5 Big-Ip Access Policy Manager
CVE-2025-23239Same product: F5 Big-Ip Access Policy Manager
CVE-2025-22846Same product: F5 Big-Ip Access Policy Manager
CVE-2025-24497Same product: F5 Big-Ip Policy Enforcement Manager
CVE-2025-53521Same product: F5 Big-Ip Access Policy Manager
CVE-2025-24312Same product: F5 Big-Ip Advanced Firewall Manager

References