Every CVESearch/Get API key

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...

9.8 CriticalIn KEVPublic exploit

CVE-2020-5902 is a critical vulnerability (CVSS 9.8) in F5 Big-ip, published July 1, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 100th percentile. No source names a fixed version.

Severity
9.8 CriticalCVSS 3.1, NVD
Exploit chance
100.0%EPSS, 100th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 34.9 points since Apr 14, 2021
90%50%10%1%

Affected products

Show 3 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitF5 BIG-IP TMUI Directory Traversal and File Upload RCE2020-06-30
PoC in GitHubdwisiswant0/CVE-2020-59022020-07-04
Exploit-DBBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC)2020-07-05
PoC in GitHubaqhmal/CVE-2020-5902-Scanner2020-07-05
PoC in GitHubar0dd/CVE-2020-59022020-07-05
PoC in GitHubjas502n/CVE-2020-59022020-07-05
PoC in GitHubnsflabs/CVE-2020-59022020-07-05
PoC in GitHubrwincey/CVE-2020-5902-NSE2020-07-05
PoC in GitHubyassineaboukir/CVE-2020-59022020-07-05
PoC in GitHub0xAbdullah/CVE-2020-59022020-07-06
Show 20 moreShow less
Public exploits
SourceLinkDate
Exploit-DBBIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution2020-07-06
PoC in GitHubJSec1337/RCE-CVE-2020-59022020-07-06
PoC in GitHubZinkuth/F5-BIG-IP-CVE-2020-59022020-07-06
PoC in GitHubcybersecurityworks553/scanner-CVE-2020-59022020-07-06
PoC in GitHubdunderhay/CVE-2020-59022020-07-06
PoC in GitHubjinnywc/CVE-2020-59022020-07-06
PoC in GitHublijiaxing1997/CVE-2020-5902-POC-EXP2020-07-06
PoC in GitHubqlkwej/poc-CVE-2020-59022020-07-06
PoC in GitHubr0ttenbeef/cve-2020-59022020-07-06
PoC in GitHubsv3nbeast/CVE-2020-5902_RCE2020-07-06
PoC in GitHubyasserjanah/CVE-2020-59022020-07-06
PoC in GitHubAny3ite/CVE-2020-5902-F5BIG2020-07-07
PoC in GitHubajdumanhug/CVE-2020-59022020-07-07
PoC in GitHubcristiano-corrado/f5_scanner2020-07-07
PoC in GitHubinho28/CVE-2020-5902-F5-BIGIP2020-07-07
PoC in GitHubjiansiting/CVE-2020-59022020-07-07
PoC in GitHubk3nundrum/CVE-2020-59022020-07-07
PoC in GitHubGovindPalakkal/EvilRip2020-07-08
Exploit-DBF5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion2020-07-26
NucleiF5 BIG-IP TMUI - Remote Code Execution

What each source reports

NVD Score used9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
CVE-2020-5902
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-22
Updated
2026-11-02
CVE List9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
CVE-2020-5902
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2020-270569.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
EUVD-2020-27056
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2859-2hr6-f86v9.8

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Record
GHSA-2859-2hr6-f86v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-94
Updated
2026-11-02
CISA KEVNo score

F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.

Record
CVE-2020-5902
Weakness
CWE-22
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less
This page doesn't list everything

The full exploit list has 31 more links.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open