F5 Networks has disclosed a high-severity command injection vulnerability (CVE-2025-31644) in its BIG-IP products<\/a> running in Appliance mode.\u00a0<\/p>\n The vulnerability exists in an undisclosed iControl REST endpoint and BIG-IP TMOS Shell (tmsh) command, allowing attackers to bypass Appliance mode security restrictions.\u00a0<\/p>\n Classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the flaw received a CVSS v3.1 score of 8.7 and a CVSS v4.0 score of 8.5, both rated as \u201cHigh\u201d severity.<\/p>\n \u201cThis command injection vulnerability may allow an authenticated attacker to cross a security boundary and execute arbitrary Advanced Shell (bash) commands,\u201d F5 stated in its security advisory.\u00a0<\/p>\n The vulnerability affects BIG-IP versions 17.1.0-17.1.2, 16.1.0-16.1.5, and 15.1.0-15.1.10.<\/p>\n Security researcher Matei \u201cMal\u201d Badanoiu of Deloitte discovered that the \u201cfile\u201d parameter of the \u201csave\u201d command is particularly vulnerable to command injection attacks.\u00a0<\/p>\n When exploited, this vulnerability allows attackers to manipulate command syntax to execute unintended operations with elevated privileges.<\/p>\n A proof-of-concept exploit released on GitHub<\/a> demonstrates how attackers can craft malicious commands using shell metacharacters to split legitimate operations and inject arbitrary commands:<\/p>\n This exploit terminates the save command prematurely with the }; sequence and then executes a system call via bash -c id to print the current user\u2019s ID-confirming execution as root.<\/p>\n The vulnerability can only be exploited by attackers who have valid administrator credentials and network access to the affected iControl REST endpoint or local access to the affected tmsh command.<\/p>\n While the attack surface is limited to authenticated users, the potential impact remains significant as it allows privileged users<\/a> to execute commands beyond their intended authorization level.<\/p>\n Successful exploitation allows attackers to:<\/p>\n Security experts note that there is no data plane exposure, meaning the vulnerability is limited to the control plane only.<\/p>\nCommand Injection in F5 BIG-IP \u201csave\u201d Command<\/strong><\/h2>\n
![\"\"](\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcM9zmmoTdaBmfWaRZledDTmEgjq6TgVoca9VmBwTQkG_6DhkS1T8sF3TZB1CFKy_b75CnwMXY8FSIqM2RvpfC19RL5ZOhMrvgB--sxpX_NbTFAMrxSLB3wfmupEYpLyQ8h_GTD_A?key=80WMCsGc39QdlAKbRgkjlQ\")
\n