PT-2025-42345 · F5 · Big-Ip Tmos+2

Published 2025-10-15 · Updated 2025-10-21 · CVE-2025-59481

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to the fixed version

Description A security issue exists in the iControl REST and BIG-IP TMOS Shell (tmsh) command that could allow an authenticated attacker with resource administrator privileges to execute arbitrary system commands with elevated privileges. A successful exploit could enable the attacker to bypass security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2025-59481

Affected Products

Big-Ip Tmos

F5 Big-Ip

Icontrol Rest

References · 7

• https://my.f5.com/manage/s/article/K000156642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59481 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59481 · Vendor Advisory
• https://twitter.com/CVEnew/status/1978545063690170462 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1978510028563681315 · Twitter Post
• https://t.me/cveNotify/139738 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978586519087513637 · Twitter Post