BIG-IP Appliance Mode iControl REST Vulnerability Bypass

A vulnerability exists in BIG-IP systems running in Appliance mode, allowing an authenticated attacker with Administrator privileges to bypass Appliance mode restrictions. This could lead to unauthorized access to read and modify arbitrary system files. The issue is confined to the control plane, with no exposure in the data plane.

Impact

Exploitation of this vulnerability could allow an authenticated attacker with Administrator rights to bypass Appliance mode restrictions, potentially leading to unauthorized access and modification of system files.

Remediation

Users can upgrade to BIG-IP versions 17.5.1.6, 17.1.3.2, or 21.0.0.2, depending on their current version. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.