InfoSecBulletin Cybersecurity for mankind
Security researchers have released a proof-of-concept exploit for CVE-2025-20029, a serious command injection vulnerability in F5’s BIG-IP application delivery controllers.
The flaw has a CVSS v3.1 score of 8.8 and allows authenticated attackers to execute arbitrary system commands due to improper handling of special elements in the iControl REST API and TMOS Shell (tmsh).
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
Attackers can exploit vulnerabilities to gain root-level access from standard user privileges, jeopardizing the entire BIG-IP control plane.
The vulnerability arises from insufficient input sanitization in the tmsh command-line interface’s save functionality, where attackers can inject malicious parameters containing shell metacharacters like ; or &&.
This exploits F5’s limited command environment by mishandling user-supplied arguments in system() calls. Exploitation needs valid credentials, but it’s easy to execute because vulnerable command sequences are predictable.
Researchers showed that attackers can use stolen credentials along with this vulnerability to run reconnaissance commands, write malicious files to /var/tmp, and escalate privileges by injecting cron jobs.
Proof-of-Concept Exploit Mechanics:
The released PoC leverages BIG-IP’s REST API endpoint /mgmt/tm/util/bash to bypass command restrictions. A crafted JSON payload exploits the improper argument handling in the configuration backup process.
Successful execution returns a 200 OK response while running injected commands with root privileges.
Analysts confirm the exploit chain can:
Extract administrative credentials from /config/bigip.license
Modify iRule configurations to establish persistent backdoors
Disrupt traffic management policies through tmsh delete operations
Mitigation Strategies:
Temporary mitigations include:
Restricting iControl REST access via port lockdown settings on self-IPs.
Implementing network segmentation for management interfaces.
Enforcing strict RBAC policies to limit tmsh command availability.
CVE-2025-20029 represents a critical infrastructure threat requiring prioritized remediation.
Organizations should apply F5’s security updates within 24 hours, audit systems exposed to management interface traffic, and implement runtime application self-protection (RASP) rules to detect command injection.
As network appliances are targeted more often, the security community stresses the importance of strengthening API endpoints and using zero-trust principles for access management.
Source: GitHub, cybersecuritynews
