Critical Vulnerability in F5 BIG-IP Appliance Mode Exposes Systems to Command Injection
A newly revealed high-risk flaw in F5’s BIG-IP systems, tracked as CVE-2025-31644, has brought attention to a serious command injection risk affecting deployments operating in Appliance mode.
This vulnerability stems from a previously undisclosed weakness within a specific iControl REST API endpoint and the TMOS Shell (tmsh) interface. Threat actors exploiting this vector can bypass critical mode-enforced security controls, escalating their privileges and gaining unauthorized access to execute system-level commands.
The flaw is categorized under CWE-78, a well-known class of vulnerabilities involving improper input sanitization in operating system commands. It has been assigned severity scores of 8.7 (CVSS v3.1) and 8.5 (CVSS v4.0) — both considered High impact.
According to F5’s security bulletin, authenticated attackers can leverage this loophole to breach isolation boundaries and run arbitrary shell (bash) commands, effectively seizing deeper control of the system.
Affected Versions
The issue impacts BIG-IP versions:
- 17.1.0 through 17.1.2
- 16.1.0 through 16.1.5
- 15.1.0 through 15.1.10
Deep Dive: Exploitable “save” Command Parameter
Security researcher Matei “Mal” Badanoiu from Deloitte uncovered that the vulnerability lies in the use of the file parameter within the “save” tmsh command. Improper validation allows malicious actors to inject shell metacharacters, turning seemingly valid commands into vectors for executing arbitrary code.
This discovery has been further validated by the release of a proof-of-concept (PoC) exploit on GitHub. The PoC showcases how attackers can manipulate command syntax to break out of expected behavior and inject their own operations, often with elevated privileges — a dangerous capability in tightly controlled environments.
Exploit Insight: How a Save Command Hijack Unlocks Root Access in BIG-IP
In a stark illustration of command injection risks, attackers can weaponize a malformed save command to hijack F5 BIG-IP systems. By appending the \}; string, the command is prematurely terminated, allowing the attacker to inject bash -c id—a technique that instantly verifies root-level command execution.
This isn’t an open-door vulnerability—it requires attackers to already hold administrative credentials and have either network access to the vulnerable iControl REST interface or direct access to the tmsh CLI on the target system.
Despite the narrow entry points, the consequences are anything but minor. The flaw gives trusted users the power to operate well outside their intended bounds—with full root-level control on the management interface.
What a Compromised Admin Can Do
With successful exploitation, an attacker can:
- Run arbitrary system commands as root
- Manipulate files—including creation and deletion—on the BIG-IP system
- Interact with self IP configurations
- Defeat Appliance mode’s intended security boundary
Crucially, experts emphasize this is a control plane–only vulnerability. The data plane—where actual traffic flows—is not affected. Still, the attack potential is significant, especially in tightly segmented or high-assurance environments where control plane integrity is paramount.
| Risk Category | Description |
|—————-|————-|
Impacted Products | BIG-IP versions: 17.1.0–17.1.2, 16.1.0–16.1.5, and 15.1.0–15.1.10
Potential Impact | Full command execution on the system with root-level privileges
Conditions for Exploitation | – Authenticated administrative access required <br> – Network access to the iControl REST API or local access to the tmsh interface
CVSS v3.1 Severity Rating | 8.7 / 10 – High
Mitigation Strategy: Urgent Steps to Secure BIG-IP Systems
F5 has issued security fixes for impacted BIG-IP versions. To eliminate risk from this critical command injection flaw, organizations should upgrade to the following safe releases without delay:
- 17.1.2.2
- 16.1.6
- 15.1.10.7
Where immediate patching isn’t feasible, F5 outlines a set of tactical controls to reduce the attack surface:
- Disable external iControl REST exposure by setting Port Lockdown on self IPs to “Allow None”
- Cut off REST API access via the management interface
- Limit SSH access strictly to known, trusted networks
- Apply packet filters to restrict inbound access to approved IP ranges
Importantly, F5 stresses that no workaround can fully mitigate this risk without also restricting admin access—since the vulnerability relies on authenticated users. As they put it:
“Only fully trusted users should retain access to the system.”
Organizations leveraging BIG-IP should immediately evaluate their infrastructure, verify current versioning, and prioritize either patch deployment or strict access lockdowns to prevent abuse of this vulnerability by privileged users.
