Vulnerability Details : CVE-2020-5902

Public exploit exists!
Used for ransomware!
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Published 2020-07-01 15:15:15
Updated 2024-07-25 16:42:51
Source F5 Networks
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2020-5902

CVE-2020-5902 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2020-5902
Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2020-5902

EPSS FAQ
97.54%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-5902

  • F5 BIG-IP TMUI Directory Traversal and File Upload RCE
    Disclosure Date: 2020-06-30
    First seen: 2020-07-07
    exploit/linux/http/f5_bigip_tmui_rce
    This module exploits a directory traversal in F5's BIG-IP Traffic Management User Interface (TMUI) to upload a shell script and execute it as the Unix root user. Unix shell access is obtained by escaping the restricted Traffic Management Shell (TMS
  • F5 BIG-IP TMUI Directory Traversal and File Upload RCE
    Disclosure Date: 2020-06-30
    First seen: 2023-11-04
    exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902
    This module exploits a directory traversal in F5's BIG-IP Traffic Management User Interface (TMUI) to upload a shell script and execute it as the Unix root user. Unix shell access is obtained by escaping the restricted Traffic Management Shell (TMS

CVSS scores for CVE-2020-5902

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2020-5902

  • The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-5902

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close