Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
High

Privilege Escalation in F5 BIG-IP iControl REST and tmsh

IdentifiersCVE-2025-59481CWE-250· Execution with Unnecessary…

CVE-2025-59481 is a privilege escalation vulnerability in F5 BIG-IP affecting an undisclosed command exposed through the iControl REST management API and the BIG-IP TMOS Shell (tmsh). According to the provided content, an authenticated attacker with at least the Resource Administrator role can execute arbitrary system commands with higher privileges than intended, allowing the attacker to cross a security boundary. The issue is described as stemming from improper privilege separation and unnecessary or excessive privileges assigned to certain management commands. In practice, this undermines BIG-IP's role-based access control model by permitting a user with limited administrative rights to reach system-level command execution through management-plane functionality.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated attacker to escalate privileges and execute arbitrary system commands at a higher privilege level on the BIG-IP system. The provided content indicates this can cross established security boundaries and may enable compromise of the underlying operating system, application traffic, cryptographic keys, and critical configuration data. Because the flaw affects management interfaces on infrastructure devices, compromise could materially affect device integrity and administrative trust boundaries.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to BIG-IP management interfaces, especially iControl REST, to trusted administrative networks only, and do not expose management interfaces to the public internet. Limit assignment of Resource Administrator and similar privileged roles to only those accounts that require them, enforce strong authentication and credential hygiene, and monitor use of iControl REST and tmsh for anomalous command execution or privilege escalation behavior. Where immediate patching is not possible, segment affected appliances and increase logging and threat hunting around management-plane access.

Remediation

Patch, then assume compromise.

Apply the vendor-provided fixes in the supported F5 BIG-IP versions identified in F5 advisory K000156642 and the October 2025 quarterly security guidance. The content states that End of Technical Support versions were not evaluated, so affected organizations should upgrade unsupported deployments to supported releases before applying the relevant fixed version or engineering hotfix. Follow F5's product-specific upgrade guidance for the affected BIG-IP branch.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
F5Big-Ip Access Policy Managerapplication
F5Big-Ip Advanced Firewall Managerapplication
F5Big-Ip Advanced Web Application Firewallapplication
F5Big-Ip Analyticsapplication
F5Big-Ip Application Acceleration Managerapplication
F5Big-Ip Application Security Managerapplication
F5Big-Ip Application Visibility And Reportingapplication
F5Big-Ip Automation Toolchainapplication
F5Big-Ip Carrier-Grade Natapplication
F5Big-Ip Container Ingress Servicesapplication
F5Big-Ip Ddos Hybrid Defenderapplication
F5Big-Ip Domain Name Systemapplication
F5Big-Ip Edge Gatewayapplication
F5Big-Ip Fraud Protection Serviceapplication
F5Big-Ip Global Traffic Managerapplication
F5Big-Ip Link Controllerapplication
F5Big-Ip Local Traffic Managerapplication
F5Big-Ip Policy Enforcement Managerapplication
F5Big-Ip Ssl Orchestratorapplication
F5Big-Ip Webacceleratorapplication
F5Big-Ip Websafeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.