CVE-2020-5902criticalunder attackransomwareCWE-22

CVE-2020-5902: critical vulnerability in BIG-IP

Published · Updated

Follow this CVE+ Monitor BIG-IP+ Monitor BIG-IP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon3 days
Published on NVDJul 1
1st PoC+3d
metasploitJun 30
CISA KEV+490d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateBackdoorDiplomacy MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A critical vulnerability in F5 BIG-IP's web management interface allows attackers to execute arbitrary code on affected systems without authentication. This flaw affects multiple versions and can lead to complete system compromise.

Technical detail

CVE-2020-5902 is a pre-authentication RCE vulnerability in BIG-IP TMUI affecting versions 11.6.1–15.1.0.3, exploitable via undisclosed pages with a network attack vector. The vulnerability allows unauthenticated remote code execution with CVSS 9.8 severity, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · BIG-IP
public PoCs found — 106
exploitdbwww.exploit-db.com/exploits/48643unverifiedexploitdbwww.exploit-db.com/exploits/48642unverifiedexploitdbwww.exploit-db.com/exploits/48711unverifiedgithubgithub.com/jas502n/CVE-2020-5902★ 374githubgithub.com/yassineaboukir/CVE-2020-5902★ 70githubgithub.com/theLSA/f5-bigip-rce-cve-2020-5902★ 62githubgithub.com/aqhmal/CVE-2020-5902-Scanner★ 55githubgithub.com/yasserjanah/CVE-2020-5902★ 42githubgithub.com/dunderhay/CVE-2020-5902★ 36githubgithub.com/f5devcentral/cve-2020-5902-ioc-bigip-checker★ 16githubgithub.com/zhzyker/CVE-2020-5902★ 13githubgithub.com/PushpenderIndia/CVE-2020-5902-Scanner★ 12githubgithub.com/ar0dd/CVE-2020-5902★ 12githubgithub.com/lijiaxing1997/CVE-2020-5902-POC-EXP★ 10githubgithub.com/west9b/F5-BIG-IP-POC★ 10githubgithub.com/Al1ex/CVE-2020-5902★ 10githubgithub.com/dwisiswant0/CVE-2020-5902★ 9githubgithub.com/rwincey/CVE-2020-5902-NSE★ 8githubgithub.com/nsflabs/CVE-2020-5902★ 8githubgithub.com/rockmelodies/CVE-2020-5902-rce-gui★ 8githubgithub.com/sv3nbeast/CVE-2020-5902_RCE★ 8githubgithub.com/GovindPalakkal/EvilRip★ 6githubgithub.com/MrCl0wnLab/checker-CVE-2020-5902★ 5githubgithub.com/jiansiting/CVE-2020-5902★ 4githubgithub.com/d4rk007/F5-Big-IP-CVE-2020-5902-mass-exploiter★ 4githubgithub.com/corelight/CVE-2020-5902-F5BigIP★ 4githubgithub.com/34zY/APT-Backpack★ 3githubgithub.com/murataydemir/CVE-2020-5902★ 2githubgithub.com/qiong-qi/CVE-2020-5902-POC★ 2githubgithub.com/DeepSecurity-Pe/GoF5-CVE-2020-5902★ 2githubgithub.com/r0ttenbeef/cve-2020-5902★ 2githubgithub.com/faisalfs10x/F5-BIG-IP-CVE-2020-5902-shodan-scanner★ 2githubgithub.com/z3n70/CVE-2020-5902★ 2githubgithub.com/cybersecurityworks553/scanner-CVE-2020-5902★ 2githubgithub.com/Zinkuth/F5-BIG-IP-CVE-2020-5902★ 1githubgithub.com/renanhsilva/checkvulnCVE20205902★ 1githubgithub.com/JSec1337/RCE-CVE-2020-5902★ 1githubgithub.com/qlkwej/poc-CVE-2020-5902★ 1githubgithub.com/0xAbdullah/CVE-2020-5902★ 1githubgithub.com/halencarjunior/f5scan★ 1githubgithub.com/haisenberg/CVE-2020-5902★ 1githubgithub.com/amitlttwo/CVE-2020-5902★ 1githubgithub.com/jinnywc/CVE-2020-5902★ 1githubgithub.com/yora1928/cve-2020-5902★ 1githubgithub.com/Shu1L/CVE-2020-5902-fofa-scan★ 1githubgithub.com/flyopenair/CVE-2020-5902★ 0githubgithub.com/Any3ite/CVE-2020-5902-F5BIG★ 0githubgithub.com/ajdumanhug/CVE-2020-5902★ 0githubgithub.com/GoodiesHQ/F5-Patch★ 0githubgithub.com/cristiano-corrado/f5_scanner★ 0githubgithub.com/momika233/cve-2020-5902★ 0githubgithub.com/ashrafzaryouh/CVE-2020-5902★ 0githubgithub.com/TheCyberViking/CVE-2020-5902-Vuln-Checker★ 0githubgithub.com/DevRafaelprogrammer/F5-BIG-IP★ 0githubgithub.com/k3nundrum/CVE-2020-5902★ 0githubgithub.com/superzerosec/cve-2020-5902★ 0githubgithub.com/ludy-dev/BIG-IP-F5-TMUI-RCE-Vulnerability★ 0githubgithub.com/freeFV/CVE-2020-5902-fofa-scan★ 0githubgithub.com/0xBlackash/CVE-2020-5902★ 0githubgithub.com/dnerzker/CVE-2020-5902★ 0githubgithub.com/inho28/CVE-2020-5902-F5-BIGIP★ 0vulncheckvulncheck.com/xdb/cc8951c30e19unverifiedvulncheckvulncheck.com/xdb/803d0da56727unverifiedcve_referencepacketstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/49a09a65578funverifiedvulncheckvulncheck.com/xdb/d2deaeca3c8dunverifiedvulncheckvulncheck.com/xdb/9b34669e9e6bunverifiedvulncheckvulncheck.com/xdb/d6c5c4d13a05unverifiedvulncheckvulncheck.com/xdb/84da9e97c9d8unverifiedvulncheckvulncheck.com/xdb/f4a6551a3d25unverifiedvulncheckvulncheck.com/xdb/cb20275ece2funverifiedvulncheckvulncheck.com/xdb/015b4ecd80f4unverifiedvulncheckvulncheck.com/xdb/83a6db79a08bunverifiedvulncheckvulncheck.com/xdb/215e30ad1ec1unverifiedvulncheckvulncheck.com/xdb/5965f23f2c23unverifiedvulncheckvulncheck.com/xdb/f74eaaf672bcunverifiedvulncheckvulncheck.com/xdb/88f1fcaeb598unverifiedvulncheckvulncheck.com/xdb/a8f50138be81unverifiedvulncheckvulncheck.com/xdb/ee5ad494cf44unverifiedvulncheckvulncheck.com/xdb/2f35578b6a4eunverifiedvulncheckvulncheck.com/xdb/d13ebff2714eunverifiedvulncheckvulncheck.com/xdb/aaa51d1dde07unverifiedvulncheckvulncheck.com/xdb/3d3c1efc21d6unverifiedvulncheckvulncheck.com/xdb/c9200a88cc26unverifiedvulncheckvulncheck.com/xdb/56bfabceae4aunverifiedvulncheckvulncheck.com/xdb/9d229282dfa7unverifiedvulncheckvulncheck.com/xdb/80de95eed85cunverifiedvulncheckvulncheck.com/xdb/ad3e875990f5unverifiedvulncheckvulncheck.com/xdb/1a0d5e33fc45unverifiedvulncheckvulncheck.com/xdb/73f9e787074dunverifiedvulncheckvulncheck.com/xdb/86fe209dce52unverifiedvulncheckvulncheck.com/xdb/5283a75d948bunverifiedvulncheckvulncheck.com/xdb/9fa6bc3af413unverifiedvulncheckvulncheck.com/xdb/7436903b93b3unverifiedvulncheckvulncheck.com/xdb/8221dd68e259unverifiedvulncheckvulncheck.com/xdb/5e821a582ff3unverifiedvulncheckvulncheck.com/xdb/80f18532fc05unverifiedvulncheckvulncheck.com/xdb/0f0c474655e0unverifiedcve_referencepacketstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/158414/Checker-CVE-2020-5902.htmlunverifiedvulncheckvulncheck.com/xdb/04c5c37985c6unverifiedcve_referencepacketstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.htmlunverifiedvulncheckvulncheck.com/xdb/7a74e348d282unverifiedvulncheckvulncheck.com/xdb/c19b970b5d78unverifiedcve_referencepacketstormsecurity.com/files/175671/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.