F5 BIG-IP Privilege Escalation Vulnerability via iControl SOAP

A privilege escalation vulnerability has been identified in F5 BIG-IP systems. An authenticated attacker with Resource Administrator or Administrator roles can exploit this vulnerability by modifying configuration objects through the iControl SOAP interface. This issue allows the attacker to escalate privileges or bypass restrictions in Appliance mode deployments, potentially crossing a security boundary. The vulnerability is limited to the control plane and does not affect the data plane.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain elevated rights or access restricted functions within the BIG-IP system.

Remediation

Users can upgrade to BIG-IP versions 17.5.1.6, 17.1.3.2, or 21.0.0.2, all of which include the necessary fix. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.