{"id":"CVE-2025-31644","title":"Appliance mode BIG-IP iControl REST and tmsh vulnerability","summary":"When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitra…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-77"],"vendor":"F5","product":"BIG-IP","affected":["BIG-IP >= 17.1.0 < 17.1.2.2","BIG-IP >= 16.1.0 < 16.1.6","BIG-IP >= 15.1.0 < 15.1.10.7"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2025-05-15T04:01:16.370657Z"},"exploitAvailable":true,"published":"2025-05-07","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:02:58.528Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-31644","references":[{"url":"https://my.f5.com/manage/s/article/K000148591"}],"tags":["cve.org","exploit-available"],"epss":0.24304,"epssPercentile":0.97873,"exploits":{"github":1,"githubRepos":["https://github.com/mbadanoiu/CVE-2025-31644"],"checkedAt":"2026-11-06T16:43:00.054Z"},"ingestedAt":"2026-11-05T20:33:06.550Z","slug":"CVE-2025-31644","body":"## Overview\n\nWhen running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n## Affected\n\n- `BIG-IP >= 17.1.0 < 17.1.2.2`\n- `BIG-IP >= 16.1.0 < 16.1.6`\n- `BIG-IP >= 15.1.0 < 15.1.10.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":65,"depthScoreParts":{"impact":47.8,"likelihood":4.9,"exploitation":12,"ransomware":0},"changes":[]}