F5 BIG-IP Appliance Mode Command Injection (CVE-2025-31644)
Application Details
BIG-IP is a collection of hardware platforms and software solutions which provide numerous services solely focused on security, reliability, and performance.
Vulnerability
A command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh), when Appliance mode is activated.
Identification
This command could potentially allow an authenticated attacker, with administrator role privileges, to execute arbitrary system commands. A successful exploit could allow the attacker to cross a security boundary.
POST /mgmt/tm/sys/config
{
"command":"save",
"options": [
{"file":"/var/tmp/`bash'${IFS}-c${IFS}'id'|'tee'${IFS}-
a${IFS}'mal_was_here`.scf", "passphrase":"aaaa"}
]
}Detection
By turning this into a traffic file and matching rule, we are able to detect attempts to execute arbitrary commands on the system.
Coverage
Idappcom have created signature 8025967 along with a traffic file for this vulnerability.
References
Traffic IQ
If you are concerned that your business may be at risk of this vulnerability or others why not try out our Traffic IQ software which can scan your defences and report any issues. Learn more here: https://www.idappcom.co.uk/traffic-iq-professional
This is a critical heads-up regarding the CVE-2025-31644 command injection in F5 BIG-IP's Appliance mode. The example payload provided clearly illustrates how an authenticated admin could execute arbitrary commands, making rapid detection via solutions like Idappcom's signature crucial. It's concerning to see such a vulnerability that could effectively leave an admin panel's security as wide open as a game of slope unblocked, if not properly mitigated.
The discovery of this command injection in F5 BIG-IP's Appliance mode, even with requiring admin privileges, is a serious concern. The example using bash to execute id shows how easily an attacker could gain a significant advantage, effectively achieving a slope unblocked route to full system compromise. This highlights the critical need for immediate patching.