cbcvebase.
CVE-2025-31644
published 2025-05-07

CVE-2025-31644: When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow…

PriorityP266high8.7CVSS 3.1
AVNACLPRHUINSCCHIHAN
EPSS
27.98%
97.9th percentile
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

88 ranges· showing 25
VendorProductVersion rangeFixed in
f5big-ip>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip>= 16.1.0 < 16.1.616.1.6
f5big-ip>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_aam——
f5big-ip_access_policy_manager>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_access_policy_manager>= 16.1.0 < 16.1.616.1.6
f5big-ip_access_policy_manager>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_advanced_firewall_manager>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_advanced_firewall_manager>= 16.1.0 < 16.1.616.1.6
f5big-ip_advanced_firewall_manager>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_advanced_waf——
f5big-ip_advanced_web_application_firewall>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_advanced_web_application_firewall>= 16.1.0 < 16.1.616.1.6
f5big-ip_advanced_web_application_firewall>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_afm——
f5big-ip_analytics——
f5big-ip_analytics>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_analytics>= 16.1.0 < 16.1.616.1.6
f5big-ip_analytics>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_apm——
f5big-ip_application_acceleration_manager>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_application_acceleration_manager>= 16.1.0 < 16.1.616.1.6
f5big-ip_application_acceleration_manager>= 17.1.0 < 17.1.2.217.1.2.2
f5big-ip_application_security_manager>= 15.1.0 < 15.1.10.715.1.10.7
f5big-ip_application_security_manager>= 16.1.0 < 16.1.616.1.6

Detection & IOCsextracted from sources · hover to see the quote

url/mgmt/tm/
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS F5 BIG-IP Authenticated Command Injection (CVE-2025-31644)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/mgmt/tm/"; fast_pattern; http.request_body; content:"|22|save|22|"; content:"|22|file|22 3a|"; pcre:"/^\s*?\x22[^\x22}*?[\x3b\x7c\x24\x60]/R"; reference:url,github.com/mbadanoiu/CVE-2025-31644; reference:cve,2025-31644; classtype:web-application-attack; sid:2062293; rev:1; metadata:affected_product F5, attack_target Server, tls_state TLSDecrypt, created_at 2025_05_13, cve CVE_2025_31644, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
|22|save|22| in HTTP request body
  • →Look for authenticated HTTP POST requests to the iControl REST endpoint /mgmt/tm/ containing both 'save' and 'file:' keys in the request body — this is the undisclosed tmsh command path exploited for injection.
  • →Within the request body, flag any JSON string value (after a quote character) that immediately contains shell metacharacters: semicolon (0x3b), pipe (0x7c), dollar sign (0x24), or backtick (0x60) — these are the injection delimiters.
  • →The vulnerability is only exploitable when BIG-IP is running in Appliance mode; detections should be prioritised/scoped to Appliance-mode deployments. Requires an authenticated administrator-role session. ↗
  • →Successful exploitation crosses a security boundary (Appliance mode sandbox escape); correlate any unexpected OS-level process spawning from the BIG-IP management plane (tmsh/iControl REST parent processes) as a post-exploitation indicator. ↗
  • →Affected versions are 15.1.0–15.1.10.7, 16.1.0–16.1.6, and 17.1.0–17.1.2.2. Use version banners or asset inventory to prioritise unpatched BIG-IP instances for monitoring. ↗
  • →The Snort/Suricata rule (SID 2062293) is tagged for TLS-decrypted traffic (tls_state TLSDecrypt / deployment SSLDecrypt); ensure your sensor has TLS inspection enabled on the management interface to catch this attack.
  • ·The vulnerability only applies when BIG-IP is running in Appliance mode; standard (non-Appliance) mode deployments are not affected by the security boundary crossing aspect. ↗
  • ·Software versions that have reached End of Technical Support (EoTS) are not evaluated by F5 and may also be vulnerable but will not receive patches. ↗
  • ·The specific iControl REST / tmsh command vector is undisclosed by F5, limiting the ability to write highly precise signatures beyond the observable HTTP patterns (POST to /mgmt/tm/ with save/file body keys and shell metacharacters). ↗

CVSS provenance

nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
nvdv4.08.5HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.