CVE-2020-5902

Scores

EPSS

0.944high94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

nvd

CWEs

CWE-22

Related Vulnerabilities

Exploits

Exploit ID: CVE-2020-5902

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit ID: 48642

Source: exploitdb

URL: https://www.exploit-db.com/exploits/48642

Exploit ID: 48643

Source: exploitdb

URL: https://www.exploit-db.com/exploits/48643

Exploit ID: 48711

Source: exploitdb

URL: https://www.exploit-db.com/exploits/48711

Recommendations

Source: nvd

Apply updatesF5 has provided updated software for the several impacted versions of BIG-IP devices. Note that BIG-IP appliances as well as virtual instances are also vulnerable as identified by F5 advisories. It is highly recommended that you upgrade to the latest secure and stable software provided by F5. These updates are essential to your device’s security, even if the TMUI is not accessible over the Internet. The upgrade reduces the risk to your device being compromised using CSRF or XSS attacks.WorkaroundsIn many cases, an attack against BIG-IP’s recent vulnerabilities require access to TMUI. Blocking or disabling access to TMUI from untrusted networks is highly recommended. F5 has also provided multiple temporary workaround options in their advisory.

URL: https://www.kb.cert.org/vuls/id/290915

Vulnerable Software (14)

Type: Configuration

Vendor: f5

Product: big-ip_access_policy_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_advanced_firewall_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_advanced_web_application_firewall

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_analytics

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_application_acceleration_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_application_security_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_ddos_hybrid_defender

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_domain_name_system

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_fraud_protection_service

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd

Type: Configuration

Vendor: f5

Product: big-ip_global_traffic_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",      "versionEndExcluding": "11.6.5.2",      "versionStartIncluding": "11.6.1",      "vulnera...

Source: nvd