F5 BIG-IP and BIG-IQ iControl SOAP Privilege Escalation Vulnerability

A vulnerability exists in the iControl SOAP interface of F5 BIG-IP and BIG-IQ products, allowing authenticated users to potentially access information from other accounts. This issue is limited to the control plane and does not affect the data plane. The vulnerability is present in specific versions of BIG-IP and BIG-IQ that have not reached the End of Technical Support (EoTS) phase.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure between user accounts on the affected system.

Remediation

Users can upgrade to versions 21.0.0.1 or 17.5.1.4 for BIG-IP, or 17.1.3.1 for BIG-IP 17.1.x releases. For BIG-IQ, no specific version is available, but users should consult the F5 product and services lifecycle policy index for guidance.