{"id":"CVE-2020-5902","aliases":["EUVD-2020-27056","GHSA-2859-2hr6-f86v"],"status":"published","title":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99999,"percentile":1,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-94"],"published":"2020-07-01T00:00:00Z","modified":"2026-06-17T03:22:25Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902","title":"F5 BIG-IP TMUI Directory Traversal and File Upload RCE","type":"exploit","platform":"Linux,Unix","date":"2020-06-30","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902"},{"source":"pocgithub","id":"dwisiswant0/CVE-2020-5902","title":"dwisiswant0/CVE-2020-5902","date":"2020-07-04","url":"https://github.com/dwisiswant0/CVE-2020-5902"},{"source":"exploitdb","id":"EDB-48643","title":"BIG-IP 15.0.0 \u003c 15.1.0.3 / 14.1.0 \u003c 14.1.2.5 / 13.1.0 \u003c 13.1.3.3 / 12.1.0 \u003c 12.1.5.1 / 11.6.1 \u003c 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution (PoC)","type":"webapps","platform":"linux","date":"2020-07-05","url":"https://www.exploit-db.com/exploits/48643"},{"source":"pocgithub","id":"aqhmal/CVE-2020-5902-Scanner","title":"aqhmal/CVE-2020-5902-Scanner","date":"2020-07-05","url":"https://github.com/aqhmal/CVE-2020-5902-Scanner"},{"source":"pocgithub","id":"ar0dd/CVE-2020-5902","title":"ar0dd/CVE-2020-5902","date":"2020-07-05","url":"https://github.com/ar0dd/CVE-2020-5902"},{"source":"pocgithub","id":"jas502n/CVE-2020-5902","title":"jas502n/CVE-2020-5902","date":"2020-07-05","url":"https://github.com/jas502n/CVE-2020-5902"},{"source":"pocgithub","id":"nsflabs/CVE-2020-5902","title":"nsflabs/CVE-2020-5902","date":"2020-07-05","url":"https://github.com/nsflabs/CVE-2020-5902"},{"source":"pocgithub","id":"rwincey/CVE-2020-5902-NSE","title":"rwincey/CVE-2020-5902-NSE","date":"2020-07-05","url":"https://github.com/rwincey/CVE-2020-5902-NSE"},{"source":"pocgithub","id":"yassineaboukir/CVE-2020-5902","title":"yassineaboukir/CVE-2020-5902","date":"2020-07-05","url":"https://github.com/yassineaboukir/CVE-2020-5902"},{"source":"pocgithub","id":"0xAbdullah/CVE-2020-5902","title":"0xAbdullah/CVE-2020-5902","date":"2020-07-06","url":"https://github.com/0xAbdullah/CVE-2020-5902"},{"source":"exploitdb","id":"EDB-48642","title":"BIG-IP 15.0.0 \u003c 15.1.0.3 / 14.1.0 \u003c 14.1.2.5 / 13.1.0 \u003c 13.1.3.3 / 12.1.0 \u003c 12.1.5.1 / 11.6.1 \u003c 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution","type":"webapps","platform":"linux","date":"2020-07-06","url":"https://www.exploit-db.com/exploits/48642"},{"source":"pocgithub","id":"JSec1337/RCE-CVE-2020-5902","title":"JSec1337/RCE-CVE-2020-5902","date":"2020-07-06","url":"https://github.com/JSec1337/RCE-CVE-2020-5902"},{"source":"pocgithub","id":"Zinkuth/F5-BIG-IP-CVE-2020-5902","title":"Zinkuth/F5-BIG-IP-CVE-2020-5902","date":"2020-07-06","url":"https://github.com/Zinkuth/F5-BIG-IP-CVE-2020-5902"},{"source":"pocgithub","id":"cybersecurityworks553/scanner-CVE-2020-5902","title":"cybersecurityworks553/scanner-CVE-2020-5902","date":"2020-07-06","url":"https://github.com/cybersecurityworks553/scanner-CVE-2020-5902"},{"source":"pocgithub","id":"dunderhay/CVE-2020-5902","title":"dunderhay/CVE-2020-5902","date":"2020-07-06","url":"https://github.com/dunderhay/CVE-2020-5902"},{"source":"pocgithub","id":"jinnywc/CVE-2020-5902","title":"jinnywc/CVE-2020-5902","date":"2020-07-06","url":"https://github.com/jinnywc/CVE-2020-5902"},{"source":"pocgithub","id":"lijiaxing1997/CVE-2020-5902-POC-EXP","title":"lijiaxing1997/CVE-2020-5902-POC-EXP","date":"2020-07-06","url":"https://github.com/lijiaxing1997/CVE-2020-5902-POC-EXP"},{"source":"pocgithub","id":"qlkwej/poc-CVE-2020-5902","title":"qlkwej/poc-CVE-2020-5902","date":"2020-07-06","url":"https://github.com/qlkwej/poc-CVE-2020-5902"},{"source":"pocgithub","id":"r0ttenbeef/cve-2020-5902","title":"r0ttenbeef/cve-2020-5902","date":"2020-07-06","url":"https://github.com/r0ttenbeef/cve-2020-5902"},{"source":"pocgithub","id":"sv3nbeast/CVE-2020-5902_RCE","title":"sv3nbeast/CVE-2020-5902_RCE","date":"2020-07-06","url":"https://github.com/sv3nbeast/CVE-2020-5902_RCE"},{"source":"pocgithub","id":"yasserjanah/CVE-2020-5902","title":"yasserjanah/CVE-2020-5902","date":"2020-07-06","url":"https://github.com/yasserjanah/CVE-2020-5902"},{"source":"pocgithub","id":"Any3ite/CVE-2020-5902-F5BIG","title":"Any3ite/CVE-2020-5902-F5BIG","date":"2020-07-07","url":"https://github.com/Any3ite/CVE-2020-5902-F5BIG"},{"source":"pocgithub","id":"ajdumanhug/CVE-2020-5902","title":"ajdumanhug/CVE-2020-5902","date":"2020-07-07","url":"https://github.com/ajdumanhug/CVE-2020-5902"},{"source":"pocgithub","id":"cristiano-corrado/f5_scanner","title":"cristiano-corrado/f5_scanner","date":"2020-07-07","url":"https://github.com/cristiano-corrado/f5_scanner"},{"source":"pocgithub","id":"inho28/CVE-2020-5902-F5-BIGIP","title":"inho28/CVE-2020-5902-F5-BIGIP","date":"2020-07-07","url":"https://github.com/inho28/CVE-2020-5902-F5-BIGIP"},{"source":"pocgithub","id":"jiansiting/CVE-2020-5902","title":"jiansiting/CVE-2020-5902","date":"2020-07-07","url":"https://github.com/jiansiting/CVE-2020-5902"},{"source":"pocgithub","id":"k3nundrum/CVE-2020-5902","title":"k3nundrum/CVE-2020-5902","date":"2020-07-07","url":"https://github.com/k3nundrum/CVE-2020-5902"},{"source":"pocgithub","id":"GovindPalakkal/EvilRip","title":"GovindPalakkal/EvilRip","date":"2020-07-08","url":"https://github.com/GovindPalakkal/EvilRip"},{"source":"exploitdb","id":"EDB-48711","title":"F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion","type":"webapps","platform":"hardware","date":"2020-07-26","url":"https://www.exploit-db.com/exploits/48711"},{"source":"nuclei","id":"CVE-2020-5902","title":"F5 BIG-IP TMUI - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5902.yaml"}],"exploits_more":31,"products":[{"vendor":"f5","product":"big-ip"},{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_advanced_web_application_firewall"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_ddos_hybrid_defender"},{"vendor":"f5","product":"big-ip_domain_name_system"},{"vendor":"f5","product":"big-ip_fraud_protection_service"},{"vendor":"f5","product":"big-ip_global_traffic_manager"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"ssl_orchestrator"}],"references":[{"url":"https://support.f5.com/csp/article/K52145254","tags":["x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.kb.cert.org/vuls/id/290915","tags":["third-party-advisory","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html","tags":["x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902","tags":["x_transferred","Broken Link","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://swarm.ptsecurity.com/rce-in-f5-big-ip/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/175671/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5902","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5902"},{"url":"https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902"},{"url":"https://swarm.ptsecurity.com/rce-in-f5-big-ip"},{"url":"https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit"},{"url":"https://github.com/advisories/GHSA-2859-2hr6-f86v"}],"sources":{"cve":[{"id":"CVE-2020-5902","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","status":"published","published":"2020-07-01T00:00:00Z","modified":"2025-10-21T23:35:41.409Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:47.56691Z"}],"euvd":[{"id":"EUVD-2020-27056","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","status":"published","published":"2020-07-01T00:00:00Z","modified":"2025-10-21T23:35:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-2859-2hr6-f86v","title":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1...","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","status":"published","published":"2022-05-24T17:22:15Z","modified":"2025-10-22T00:32:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-94"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2020-5902","title":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","description":"F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.","cwes":["CWE-22"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2020-5902","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","status":"published","published":"2020-07-01T15:15:15.36Z","modified":"2026-06-17T03:22:25.473Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:08.145904Z"}]}}