CVE-2020-5902: F5 BIG-IP Access Policy Manager RCE Flaw

CVE-2020-5902 Overview

CVE-2020-5902 is a critical Remote Code Execution (RCE) vulnerability affecting F5 BIG-IP devices through the Traffic Management User Interface (TMUI), also known as the Configuration utility. This vulnerability exists in undisclosed pages within the TMUI and allows unauthenticated attackers to execute arbitrary system commands, create or delete files, disable services, and potentially gain complete control over affected BIG-IP systems.

The vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation by threat actors. Given that BIG-IP devices are commonly deployed as load balancers, firewalls, and application delivery controllers at network perimeters, successful exploitation can provide attackers with a strategic foothold into enterprise networks.

Critical Impact
Unauthenticated remote attackers can achieve complete system compromise of F5 BIG-IP devices, potentially enabling lateral movement into protected network segments, data exfiltration, and persistent access to critical infrastructure.

Affected Products

F5 BIG-IP Access Policy Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
F5 BIG-IP Advanced Firewall Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
F5 BIG-IP Local Traffic Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
F5 BIG-IP Application Security Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
F5 BIG-IP Analytics, Domain Name System, Global Traffic Manager, Link Controller, Policy Enforcement Manager
F5 BIG-IP Advanced Web Application Firewall, DDoS Hybrid Defender, Fraud Protection Service
F5 SSL Orchestrator

Discovery Timeline

July 1, 2020 - CVE-2020-5902 published to NVD
October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2020-5902

Vulnerability Analysis

This vulnerability is classified as a Path Traversal (CWE-22) issue that enables Remote Code Execution. The flaw exists within the TMUI component of BIG-IP, which provides a web-based administrative interface for managing the appliance. The vulnerability allows attackers to bypass authentication and access restrictions through specially crafted HTTP requests that exploit improper path handling.

The TMUI interface fails to properly sanitize user-supplied input in URL paths, allowing attackers to traverse directories and access files or execute commands outside the intended web root. This path traversal weakness can be chained with other functionality to achieve arbitrary file read/write capabilities and ultimately remote code execution with root privileges.

Research by security firms including Bad Packets identified over 3,000 vulnerable F5 BIG-IP endpoints exposed to the internet shortly after disclosure, highlighting the widespread exposure risk. The vulnerability's network-accessible nature, combined with no authentication requirements and low exploitation complexity, makes it an attractive target for threat actors.

Root Cause

The root cause of CVE-2020-5902 lies in improper input validation within the TMUI's request handling mechanism. The application fails to adequately sanitize URL-encoded path traversal sequences (such as ../ or its encoded variants) before processing requests. This allows attackers to escape the intended directory context and access arbitrary files on the system or invoke system utilities.

The vulnerability exists because the backend Apache web server and the Tomcat application server handle URL normalization differently. Attackers can craft requests that bypass Apache's access controls but are interpreted differently by Tomcat, allowing unauthorized access to protected resources and functionality.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker sends specially crafted HTTP requests to the TMUI interface (typically accessible on port 443) containing path traversal sequences. The exploitation flow involves:

Identifying exposed BIG-IP TMUI interfaces through network scanning
Sending crafted requests with path traversal payloads to bypass access controls
Leveraging the traversal to read sensitive files (such as /etc/passwd or configuration files)
Uploading malicious files or executing system commands through vulnerable endpoints
Achieving persistent access through webshells or modified configurations

The vulnerability can be exploited through various payload techniques including directory traversal with URL encoding, semicolon injection to bypass certain filters, and leveraging Java Server Pages (JSP) functionality for code execution. Multiple proof-of-concept exploits have been published, including those available on Packet Storm and GitHub repositories, demonstrating the accessibility of exploitation techniques to attackers.

Detection Methods for CVE-2020-5902

Indicators of Compromise

HTTP requests to TMUI containing path traversal patterns such as ..;/, hsqldb, or /tmui/login.jsp/..;/
Unexpected file access patterns in /var/log/ltm or /var/log/httpd/ logs showing traversal attempts
Creation of suspicious files in web-accessible directories, particularly JSP files outside normal locations
Unauthorized modifications to BIG-IP configuration files or iRules
Outbound network connections from BIG-IP devices to unknown external IP addresses

Detection Strategies

Monitor HTTP access logs for requests containing suspicious path traversal patterns targeting /tmui/ endpoints
Implement network-based detection rules for HTTP traffic containing CVE-2020-5902 exploitation signatures
Deploy SentinelOne Singularity to detect post-exploitation behavior including unauthorized process execution and file system modifications
Utilize vulnerability scanners to identify exposed and unpatched BIG-IP TMUI interfaces

Monitoring Recommendations

Enable detailed logging on BIG-IP devices and forward logs to a centralized SIEM for correlation and analysis
Monitor for authentication failures followed by successful administrative actions, indicating potential bypass
Implement file integrity monitoring on critical BIG-IP system files and configuration directories
Establish baseline network behavior for BIG-IP devices and alert on anomalous outbound connections

How to Mitigate CVE-2020-5902

Immediate Actions Required

Apply the security patches provided by F5 immediately; patched versions are available for all affected branches
Restrict access to the TMUI interface to trusted internal networks only; do not expose to the public internet
Review BIG-IP access logs for indicators of compromise and conduct forensic analysis if exploitation is suspected
Rotate all credentials and API keys that may have been exposed through the BIG-IP device
Consider isolating affected BIG-IP devices until patches can be applied in environments where immediate patching is not feasible

Patch Information

F5 has released security patches addressing CVE-2020-5902 across all affected version branches. Organizations should upgrade to the following minimum versions: 15.1.0.4 (for 15.x branch), 14.1.2.6 (for 14.x branch), 13.1.3.4 (for 13.x branch), 12.1.5.2 (for 12.x branch), and 11.6.5.2 (for 11.x branch). Detailed patch information and upgrade instructions are available in F5 Support Article K52145254. Organizations should prioritize patching internet-facing BIG-IP devices and those handling sensitive traffic.

Workarounds

Block TMUI access from untrusted networks by configuring Self IP Port Lockdown settings
Apply F5's recommended mitigation by adding entries to the httpd_config file to deny access to vulnerable URL patterns
Use network firewalls or access control lists to restrict access to management interfaces (ports 443, 8443) to authorized IP ranges only
Disable the TMUI interface entirely if remote management is not required, using CLI-only administration

bash

# Restrict TMUI access using tmsh
tmsh modify sys httpd allow none
tmsh save sys config

# Alternative: Limit access to specific management IP ranges
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 192.168.1.0/24 }
tmsh save sys config