What is CVE-2020-5902?

CVE-2020-5902 is a critical vulnerability in the Traffic Management User Interface (TMUI) of certain BIG-IP systems. It allows attackers to execute arbitrary code and read files on affected systems, posing a significant security risk. Impacted versions range from 11.6.1 to 15.1.0.3.

Who is impacted by CVE-2020-5902?

CVE-2020-5902 affects users of BIG-IP systems using TMUI. Impacted versions include 15.0.0 to 15.1.0.3, 14.1.0 to 14.1.2.5, 13.1.0 to 13.1.3.3, 12.1.0 to 12.1.5.1, and 11.6.1 to 11.6.5.1. This vulnerability allows attackers to execute arbitrary code and read files on these systems.

What to do if cve-2020-5902 affected you

If you're affected by the CVE-2020-5902 vulnerability, it's important to take action to protect your systems. Here are some simple steps to follow:

1. Identify affected BIG-IP versions in your infrastructure.

2. Apply the latest security patches provided by F5.

3. Monitor your systems for potential exploitation attempts.

4. Keep your software up-to-date to prevent future vulnerabilities.

By following these steps, you can help safeguard your organization against this critical vulnerability and maintain a secure remote access environment.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-5902 vulnerability, also known as F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on November 3, 2021, and the due date for required action is May 3, 2022. Organizations using affected BIG-IP systems must apply updates as per vendor instructions to address this vulnerability.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-22, which involves improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'.

Learn More

CVE-2020-5902 is a critical vulnerability affecting BIG-IP systems, posing significant security risks to organizations. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the National Vulnerability Database page or refer to the sources below:

• BIG-IP TMUI Remote Code Execution ≈ Packet Storm (Budi Khoirudin)

• BIG-IP TMUI Remote Code Execution ≈ Packet Storm (Critical Smart)

• F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution ≈ Packet Storm (metasploit.com)

• Checker CVE-2020-5902 ≈ Packet Storm (MrCl0wn Lab)