Every CVE Search/ Get API key

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...

9.8 CriticalIn KEVPublic exploit

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 34.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
CVE-2020-5902
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-22
Updated
2026-11-02
CVE List 9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
CVE-2020-5902
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2020-27056 9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
EUVD-2020-27056
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2859-2hr6-f86v 9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
GHSA-2859-2hr6-f86v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-94
Updated
2026-11-02
CISA KEV No score

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

Record
CVE-2020-5902
Weakness
CWE-22
Updated
2026-11-02

Affected products

Show 3 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitF5 BIG-IP TMUI Directory Traversal and File Upload RCE2020-06-30
PoC in GitHubdwisiswant0/CVE-2020-59022020-07-04
Exploit-DBBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC)2020-07-05
PoC in GitHubaqhmal/CVE-2020-5902-Scanner2020-07-05
PoC in GitHubar0dd/CVE-2020-59022020-07-05
PoC in GitHubjas502n/CVE-2020-59022020-07-05
PoC in GitHubnsflabs/CVE-2020-59022020-07-05
PoC in GitHubrwincey/CVE-2020-5902-NSE2020-07-05
PoC in GitHubyassineaboukir/CVE-2020-59022020-07-05
PoC in GitHub0xAbdullah/CVE-2020-59022020-07-06
Show 20 moreShow less
Public exploits
SourceLinkDate
Exploit-DBBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution2020-07-06
PoC in GitHubJSec1337/RCE-CVE-2020-59022020-07-06
PoC in GitHubZinkuth/F5-BIG-IP-CVE-2020-59022020-07-06
PoC in GitHubcybersecurityworks553/scanner-CVE-2020-59022020-07-06
PoC in GitHubdunderhay/CVE-2020-59022020-07-06
PoC in GitHubjinnywc/CVE-2020-59022020-07-06
PoC in GitHublijiaxing1997/CVE-2020-5902-POC-EXP2020-07-06
PoC in GitHubqlkwej/poc-CVE-2020-59022020-07-06
PoC in GitHubr0ttenbeef/cve-2020-59022020-07-06
PoC in GitHubsv3nbeast/CVE-2020-5902_RCE2020-07-06
PoC in GitHubyasserjanah/CVE-2020-59022020-07-06
PoC in GitHubAny3ite/CVE-2020-5902-F5BIG2020-07-07
PoC in GitHubajdumanhug/CVE-2020-59022020-07-07
PoC in GitHubcristiano-corrado/f5_scanner2020-07-07
PoC in GitHubinho28/CVE-2020-5902-F5-BIGIP2020-07-07
PoC in GitHubjiansiting/CVE-2020-59022020-07-07
PoC in GitHubk3nundrum/CVE-2020-59022020-07-07
PoC in GitHubGovindPalakkal/EvilRip2020-07-08
Exploit-DBF5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion2020-07-26
NucleiF5 BIG-IP TMUI - Remote Code Execution

Plus 31 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-5902 is a critical vulnerability (CVSS 9.8) in F5 Big-ip, published July 1, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 100th percentile. No source names a fixed version.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open