CVE-2020-5902 Overview
CVE-2020-5902 is a critical Remote Code Execution (RCE) vulnerability affecting F5 BIG-IP devices through the Traffic Management User Interface (TMUI), also known as the Configuration utility. This vulnerability exists in undisclosed pages within the TMUI and allows unauthenticated attackers to execute arbitrary system commands, create or delete files, disable services, and potentially gain complete control over affected BIG-IP systems.
The vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation by threat actors. Given that BIG-IP devices are commonly deployed as load balancers, firewalls, and application delivery controllers at network perimeters, successful exploitation can provide attackers with a strategic foothold into enterprise networks.
Critical Impact
Unauthenticated remote attackers can achieve complete system compromise of F5 BIG-IP devices, potentially enabling lateral movement into protected network segments, data exfiltration, and persistent access to critical infrastructure.
Affected Products
- F5 BIG-IP Access Policy Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
- F5 BIG-IP Advanced Firewall Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
- F5 BIG-IP Local Traffic Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
- F5 BIG-IP Application Security Manager (versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1)
- F5 BIG-IP Analytics, Domain Name System, Global Traffic Manager, Link Controller, Policy Enforcement Manager
- F5 BIG-IP Advanced Web Application Firewall, DDoS Hybrid Defender, Fraud Protection Service
- F5 SSL Orchestrator
Discovery Timeline
- July 1, 2020 - CVE-2020-5902 published to NVD
- October 27, 2025 - Last updated in NVD database
Technical Details for CVE-2020-5902
Vulnerability Analysis
This vulnerability is classified as a Path Traversal (CWE-22) issue that enables Remote Code Execution. The flaw exists within the TMUI component of BIG-IP, which provides a web-based administrative interface for managing the appliance. The vulnerability allows attackers to bypass authentication and access restrictions through specially crafted HTTP requests that exploit improper path handling.
The TMUI interface fails to properly sanitize user-supplied input in URL paths, allowing attackers to traverse directories and access files or execute commands outside the intended web root. This path traversal weakness can be chained with other functionality to achieve arbitrary file read/write capabilities and ultimately remote code execution with root privileges.
Research by security firms including Bad Packets identified over 3,000 vulnerable F5 BIG-IP endpoints exposed to the internet shortly after disclosure, highlighting the widespread exposure risk. The vulnerability's network-accessible nature, combined with no authentication requirements and low exploitation complexity, makes it an attractive target for threat actors.
Root Cause
The root cause of CVE-2020-5902 lies in improper input validation within the TMUI's request handling mechanism. The application fails to adequately sanitize URL-encoded path traversal sequences (such as ../ or its encoded variants) before processing requests. This allows attackers to escape the intended directory context and access arbitrary files on the system or invoke system utilities.
The vulnerability exists because the backend Apache web server and the Tomcat application server handle URL normalization differently. Attackers can craft requests that bypass Apache's access controls but are interpreted differently by Tomcat, allowing unauthorized access to protected resources and functionality.
Attack Vector
The attack can be executed remotely over the network without authentication. An attacker sends specially crafted HTTP requests to the TMUI interface (typically accessible on port 443) containing path traversal sequences. The exploitation flow involves:
- Identifying exposed BIG-IP TMUI interfaces through network scanning
- Sending crafted requests with path traversal payloads to bypass access controls
- Leveraging the traversal to read sensitive files (such as /etc/passwd or configuration files)
- Uploading malicious files or executing system commands through vulnerable endpoints
- Achieving persistent access through webshells or modified configurations
The vulnerability can be exploited through various payload techniques including directory traversal with URL encoding, semicolon injection to bypass certain filters, and leveraging Java Server Pages (JSP) functionality for code execution. Multiple proof-of-concept exploits have been published, including those available on Packet Storm and GitHub repositories, demonstrating the accessibility of exploitation techniques to attackers.
Detection Methods for CVE-2020-5902
Indicators of Compromise
- HTTP requests to TMUI containing path traversal patterns such as ..;/, hsqldb, or /tmui/login.jsp/..;/
- Unexpected file access patterns in /var/log/ltm or /var/log/httpd/ logs showing traversal attempts
- Creation of suspicious files in web-accessible directories, particularly JSP files outside normal locations
- Unauthorized modifications to BIG-IP configuration files or iRules
- Outbound network connections from BIG-IP devices to unknown external IP addresses
Detection Strategies
- Monitor HTTP access logs for requests containing suspicious path traversal patterns targeting /tmui/ endpoints
- Implement network-based detection rules for HTTP traffic containing CVE-2020-5902 exploitation signatures
- Deploy SentinelOne Singularity to detect post-exploitation behavior including unauthorized process execution and file system modifications
- Utilize vulnerability scanners to identify exposed and unpatched BIG-IP TMUI interfaces
Monitoring Recommendations
- Enable detailed logging on BIG-IP devices and forward logs to a centralized SIEM for correlation and analysis
- Monitor for authentication failures followed by successful administrative actions, indicating potential bypass
- Implement file integrity monitoring on critical BIG-IP system files and configuration directories
- Establish baseline network behavior for BIG-IP devices and alert on anomalous outbound connections
How to Mitigate CVE-2020-5902
Immediate Actions Required
- Apply the security patches provided by F5 immediately; patched versions are available for all affected branches
- Restrict access to the TMUI interface to trusted internal networks only; do not expose to the public internet
- Review BIG-IP access logs for indicators of compromise and conduct forensic analysis if exploitation is suspected
- Rotate all credentials and API keys that may have been exposed through the BIG-IP device
- Consider isolating affected BIG-IP devices until patches can be applied in environments where immediate patching is not feasible
Patch Information
F5 has released security patches addressing CVE-2020-5902 across all affected version branches. Organizations should upgrade to the following minimum versions: 15.1.0.4 (for 15.x branch), 14.1.2.6 (for 14.x branch), 13.1.3.4 (for 13.x branch), 12.1.5.2 (for 12.x branch), and 11.6.5.2 (for 11.x branch). Detailed patch information and upgrade instructions are available in F5 Support Article K52145254. Organizations should prioritize patching internet-facing BIG-IP devices and those handling sensitive traffic.
Workarounds
- Block TMUI access from untrusted networks by configuring Self IP Port Lockdown settings
- Apply F5's recommended mitigation by adding entries to the httpd_config file to deny access to vulnerable URL patterns
- Use network firewalls or access control lists to restrict access to management interfaces (ports 443, 8443) to authorized IP ranges only
- Disable the TMUI interface entirely if remote management is not required, using CLI-only administration
# Restrict TMUI access using tmsh
tmsh modify sys httpd allow none
tmsh save sys config
# Alternative: Limit access to specific management IP ranges
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 192.168.1.0/24 }
tmsh save sys config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
