---
id: CVE-2025-31644
title: Appliance mode BIG-IP iControl REST and tmsh vulnerability
summary: >-
  When running in Appliance mode, a command injection vulnerability exists in an
  undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow
  an authenticated attacker with administrator role privileges to execute
  arbitra…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-77
vendor: F5
product: BIG-IP
affected:
  - BIG-IP >= 17.1.0 < 17.1.2.2
  - BIG-IP >= 16.1.0 < 16.1.6
  - BIG-IP >= 15.1.0 < 15.1.10.7
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-05-15T04:01:16.370657Z'
exploitAvailable: true
published: '2025-05-07'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:58.528Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-31644'
references:
  - url: 'https://my.f5.com/manage/s/article/K000148591'
tags:
  - cve.org
  - exploit-available
epss: 0.24304
epssPercentile: 0.97873
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mbadanoiu/CVE-2025-31644'
  checkedAt: '2026-11-06T16:43:00.054Z'
ingestedAt: '2026-11-05T20:33:06.550Z'
---

## Overview

When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Affected

- `BIG-IP >= 17.1.0 < 17.1.2.2`
- `BIG-IP >= 16.1.0 < 16.1.6`
- `BIG-IP >= 15.1.0 < 15.1.10.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.