F5 BIG-IP and BIG-IQ Sensitive Information Disclosure Vulnerability

A vulnerability allowing sensitive information disclosure exists in an undisclosed iControl REST endpoint and TMOS Shell (tmsh) command. This issue may enable an authenticated attacker with resource administrator role privileges to view sensitive information. The vulnerability is present in specific versions of F5 BIG-IP and BIG-IQ software that have not reached End of Technical Support (EoTS).

Impact

Exploitation of this vulnerability could allow an authenticated attacker with resource administrator role privileges to access sensitive information. This issue affects the control plane only, with no data plane exposure.

Remediation

Users can upgrade to a version that addresses this vulnerability. For BIG-IP, versions 17.5.1.4 and 17.1.3.1 are available. BIG-IQ users can upgrade to version 8.4.1. For more information about managing F5 product hotfixes, refer to the F5 BIG-IQ hotfix and point release matrix.