Description
Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | BIG-IP | 21.0.0 – < 21.0.0.1, 17.5.0 – < 17.5.1.4, 17.1.0 – < 17.1.3.1, 16.1.0 | 21.0.0.1 |
| F5 | BIG-IQ | 8.4.0 – < 8.4.1 | 8.4.1 |
Advisories 2
- NCSC-2026-0162 Kwetsbaarheden verholpen in F5 BIG-IP en BIG-IQ producten NCSC-NL (Netherlands) · May 15, 2026
- WID-SEC-2026-1532 F5 BIG-IP Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2026
References
- https://my.f5.com/manage/s/article/K32950402 vendor-advisory patch