CVE-2020-5902
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
9.8
CVSS 3.1
100.0 %
EPSS (current)
2021-11-03
KEV addition
Yes
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: F5 / BIG-IP
Published: 2020-07-01 · Due (CISA): 2022-05-03
CWE: CWE-22 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| nuclei | http/cves/2020/CVE-2020-5902.yaml | F5 BIG-IP TMUI - Remote Code Execution | – |
| metasploit | exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902 | exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902 | 2020-06-30 |
| exploitdb | 48643 | BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC) | 2020-07-05 |
| exploitdb | 48642 | BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution | 2020-07-06 |
| exploitdb | 48711 | F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion | 2020-07-26 |
References only — no downloads or instructions.