A high-severity authentication-based vulnerability in F5 BIG-IP allows authorized administrators to escape restricted command environments and execute arbitrary commands within a bash shell.

This flaw involves an improper restriction of operations within the iHealth command, which allows an authenticated attacker possessing a resource administrator role to escape the Traffic Management Shell (tmsh) and gain unauthorized access to the underlying system bash shell.

Successful exploitation of this vulnerability permits an attacker to cross security boundaries, potentially leading to full system compromise or unauthorized configuration changes. Given the CVSS score of 8.7, this represents a significant risk to the integrity and availability of network infrastructure managed by BIG-IP devices. Organizations may face severe operational disruption if an attacker leverages this access to manipulate traffic management policies or exfiltrate sensitive system data.

Immediate Action: Upgrade to the fixed versions (17.5.1.1, 17.1.3, 16.1.6.1, or 15.1.10.8) as provided in the vendor security advisory.

Proactive Monitoring: Review system access logs for unusual activity involving the iHealth command or unexpected bash shell execution patterns.

Compensating Controls: Strictly enforce the principle of least privilege by auditing and limiting the number of users assigned the resource administrator role.

Public Exploit Available: No

The severity of this flaw necessitates immediate attention, particularly for systems exposed to administrative access. Administrators should prioritize patching the affected BIG-IP instances to the versions specified by F5 to eliminate the risk of privilege escalation. Given the potential for total system impact, verify the integrity of administrative accounts and confirm that all environment-specific mitigations are applied if immediate patching is not possible.