TI-2025-17015 Aliases CVE-2025-23239 GHSA-47pf-mc42-q29m

BIG-IP iControl REST vulnerability

MEDIUM 40CWE-77Published 2025-02-05 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00762 55th percentileScored 2026-11-07

Fix Fixed BIG-IP (F5): 17.1.2, 16.1.0, 15.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
F5	BIG-IP	17.1.1 to before 17.1.2	17.1.2, 16.1.0, 15.1.0	Patch available	CNA

BIG-IP VendorF5 Affected 17.1.1 to before 17.1.2 Fixed in 17.1.2, 16.1.0, 15.1.0 Patch available CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_analytics:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_link_controller:17.1.1:::::::*	17.1.1	Vulnerable	F5
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5

cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_analytics:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_link_controller:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.1:::::::*	17.1.1	Vulnerable	F5

cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.1:*:*:*:*:*:*:* Versions 17.1.1 Vulnerable ·F5

Remediation

Fix · CNA BIG-IP (F5) Fixed in 17.1.2, 16.1.0, 15.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-02-05
F5 BIG-IP 17.1.2
6 records Highest priority Priority MEDIUM 6 MEDIUM
Other records, highest priority first
- TI-2025-15083 TMM VulnerabilityPriority MEDIUM 45
- TI-2025-14367 BIG-IP message routing vulnerabilityPriority MEDIUM 45
- TI-2025-18218 BIG-IP PEM vulnerabilityPriority MEDIUM 44
Show all 6 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-23239
2026-10-03 Alias added: GHSA-47pf-mc42-q29m

References

Advisory 1

https://my.f5.com/manage/s/article/K000138757

TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8

See all 629 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences