An authenticated remote command injection vulnerability in F5 BIG-IP allows an attacker with high privileges to execute arbitrary system commands via the iControl REST API.

This is an OS Command Injection vulnerability (CWE-78) occurring in an iControl REST endpoint. The vulnerability is exploitable by an authenticated user with high privileges, allowing them to inject and execute arbitrary commands on the underlying operating system.

Successful exploitation provides an attacker with high-level access to the BIG-IP appliance, potentially leading to full system compromise. Given that BIG-IP often sits at the edge of the network, this vulnerability poses a severe risk to the entire network infrastructure, justifying the high CVSS score of 8.7.

Immediate Action: Apply the vendor-provided security updates to move to a patched version (e.g., 21.1.0 or later) as specified in the F5 security advisory.

Proactive Monitoring: Review iControl REST API access logs for unusual command patterns and monitor system integrity for unauthorized configuration changes.

Compensating Controls: Restrict access to the iControl REST API to known, trusted management IP addresses and enforce strong multi-factor authentication for all administrative users.

Public Exploit Available: Unknown

Organizations should prioritize patching their F5 BIG-IP appliances, as these devices are critical infrastructure. Ensure that administrative access is strictly controlled and audited to prevent exploitation by malicious or compromised internal accounts.