CVE-2025-59481: F5 BIG-IP APM Privilege Escalation Flaw

CVE-2025-59481 Overview

CVE-2025-59481 is a privilege escalation vulnerability affecting F5 BIG-IP products. An authenticated attacker holding at least the resource administrator role can execute arbitrary system commands at higher privileges through an undisclosed iControl REST endpoint and BIG-IP TMOS Shell (tmsh) command. The flaw is classified under CWE-250: Execution with Unnecessary Privileges and crosses a documented security boundary inside the BIG-IP management plane. F5 published advisory K000156642 on October 15, 2025. Software versions that have reached End of Technical Support (EoTS) were not evaluated by F5.

Critical Impact

Authenticated resource administrators on F5 BIG-IP can break out of role-based command restrictions and execute system commands with elevated privileges, leading to full appliance compromise.

Affected Products

• F5 BIG-IP Local Traffic Manager (LTM), Access Policy Manager (APM), and Advanced WAF
• F5 BIG-IP Advanced Firewall Manager (AFM), DNS, Global Traffic Manager, and SSL Orchestrator
• F5 BIG-IP Application Security Manager (ASM), Policy Enforcement Manager, DDoS Hybrid Defender, Carrier-Grade NAT, Link Controller, Edge Gateway, WebAccelerator, Analytics, Application Acceleration Manager, Application Visibility and Reporting, Automation Toolchain, Container Ingress Services, Fraud Protection Service, and WebSafe

Discovery Timeline

• 2025-10-15 - CVE-2025-59481 published to NVD and F5 advisory K000156642 released
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-59481

Vulnerability Analysis

The vulnerability resides in an undisclosed command exposed through both the iControl REST API and the BIG-IP TMOS Shell (tmsh). The affected code path executes with privileges higher than those granted to the calling role. An authenticated user with the resource administrator role, which is intended to be restricted from full system-level operations, can invoke the command to run arbitrary operating system commands on the BIG-IP appliance. This breaks the trust boundary between role-based administrative tiers and the underlying TMOS host.

The attack vector is network-based and does not require user interaction. F5 has not disclosed the specific command, function, or REST endpoint to limit pre-patch exploitation. Successful exploitation grants the attacker the ability to read sensitive configuration, modify traffic policies, pivot into adjacent management networks, and persist on the device.

Root Cause

The root cause maps to CWE-250: Execution with Unnecessary Privileges. A privileged helper or setuid-style execution path invoked by the affected tmsh and iControl REST handler does not adequately drop privileges or validate that the calling role is authorized to perform the underlying system operation. Resource administrators inherit access to system command execution that should be reserved for higher-privileged accounts.

Attack Vector

Exploitation requires valid credentials with at least the resource administrator role. The attacker reaches the BIG-IP management interface over the network, authenticates to iControl REST (typically https://<bigip>/mgmt/tm/...) or to tmsh over SSH, and invokes the undisclosed command with crafted arguments. The injected operating system commands run in the context of the elevated privilege boundary, yielding code execution on the appliance. Because F5 has not publicly disclosed the vulnerable endpoint, no public proof-of-concept exists at the time of writing.

Detection Methods for CVE-2025-59481

Indicators of Compromise

• Unexpected tmsh command executions or shell spawns originating from accounts assigned the resource administrator role.
• iControl REST POST or PUT requests to administrative endpoints from accounts that do not typically perform configuration changes.
• New local users, modified SSH keys, or unauthorized changes to /config/bigip.conf and other TMOS configuration files.
• Outbound network connections initiated by BIG-IP system processes that deviate from baseline traffic.

Detection Strategies

• Forward BIG-IP audit logs (/var/log/audit, /var/log/restjavad-audit.0.log, /var/log/secure) to a centralized log platform and alert on tmsh command anomalies executed by non-admin roles.
• Correlate iControl REST API calls with the authenticated user role, flagging resource administrator accounts that invoke endpoints typically used by full administrators.
• Hunt for process lineage where management daemons (restjavad, tmsh, mcpd) spawn /bin/sh, /bin/bash, or other interpreters outside of normal maintenance windows.

Monitoring Recommendations

• Baseline legitimate API usage per service account and alert on deviations in endpoint coverage, request volume, or source IP.
• Enable BIG-IP appliance-mode where supported to restrict root shell access and reduce the blast radius of privilege escalation.
• Monitor authentication logs for resource administrator logins from new geolocations, jump hosts, or service accounts that were previously dormant.

How to Mitigate CVE-2025-59481

Immediate Actions Required

• Apply the fixed versions listed in F5 advisory K000156642 as soon as a maintenance window allows.
• Inventory all BIG-IP accounts with the resource administrator role and remove unnecessary assignments.
• Restrict access to the BIG-IP management interface (iControl REST and SSH/tmsh) to a dedicated management network and trusted bastion hosts only.
• Rotate credentials and SSH keys for any administrative accounts that may have been exposed prior to patching.

Patch Information

F5 has released patched software versions for affected BIG-IP modules. Refer to the version matrix in F5 Security Advisory K000156642 for fixed releases that correspond to each affected branch. Versions that have reached End of Technical Support (EoTS) were not evaluated and should be upgraded to a supported, patched branch.

Workarounds

• Limit the assignment of the resource administrator role to a minimal set of accounts and use higher-tier roles only on dedicated jump hosts.
• Enforce network access controls on TCP/443 (iControl REST) and TCP/22 (tmsh over SSH) so that only authorized management subnets can reach the BIG-IP control plane.
• Enable multi-factor authentication for all BIG-IP administrative accounts where supported via external authentication providers (RADIUS, TACACS+, or SAML).

# Configuration example: restrict iControl REST and SSH access via self-IP port lockdown
tmsh modify net self <self-ip-name> allow-service { tcp:443 tcp:22 }
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh modify sys sshd allow replace-all-with { 10.0.0.0/24 }
tmsh save sys config