Detections
Analytics
CVE-2020-5902
critical
Description
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
From the Tenable Blog
CVE-2020-5902: Critical Vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI) Actively Exploited
Published: 2020-07-06
Three days after an advisory was disclosed for a critical remote code execution vulnerability in F5’s BIG-IP, active attempts to exploit vulnerable hosts have been observed in the wild. Update July 8, 2020: F5 has provided updated mitigation details after reports that researchers had discovered a way to bypass some of the mitigations. The Solutions section of our blog has been updated accordingly.
References
https://www.kb.cert.org/vuls/id/290915
http://packetstormsecurity.com/files/158414/Checker-CVE-2020-5902.html
http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html
https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
https://www.databreachtoday.com/attackers-target-zero-day-flaw-in-fortinet-security-software-a-31344
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report
https://www.tenable.com/cyber-exposure/a-look-inside-the-ransomware-ecosystem
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a
https://www.tenable.com/blog/aa23-215a-2022s-top-routinely-exploited-vulnerabilities
https://www.tenable.com/blog/cve-2022-1388-authentication-bypass-in-f5-big-ip
https://www.tenable.com/blog/one-year-later-what-can-we-learn-from-zerologon
https://github.com/BalMM-hub/IDS-Deployment-and-packet-analysis
https://github.com/chengbochuan3/CVE-Network-Device
https://github.com/ericrihm/edge-security-ground-truth
https://github.com/THU-HJY/CVE-Honeypot
https://github.com/J3ff-R3y/network-scanner-cmdb
https://github.com/hermestoola/bb-hunter-pro
https://github.com/0xAshwesker/CVE-2020-5902
https://github.com/iosec-shekhar/COIT
https://github.com/zaryouhashraf/CVE-2020-5902
https://github.com/B1ack4sh/Blackash-CVE-2020-5902
https://github.com/34zY/APT-Backpack
https://github.com/west9b/F5-BIG-IP-POC
https://github.com/haisenberg/CVE-2020-5902
https://github.com/faisalfs10x/F5-BIG-IP-CVE-2020-5902-shodan-scanner
https://github.com/ludy-dev/BIG-IP-F5-TMUI-RCE-Vulnerability
https://github.com/ltvthang/CVE-2020-5903
https://github.com/murataydemir/CVE-2020-5902
https://github.com/PushpenderIndia/CVE-2020-5902-Scanner
https://github.com/corelight/CVE-2020-5902-F5BigIP
https://github.com/5l1v3r1/CVE-2020-5902-Mass
https://github.com/Al1ex/CVE-2020-5902
https://github.com/pwnhacker0x18/CVE-2020-5902-Mass
https://github.com/qiong-qi/CVE-2020-5902-POC
https://github.com/MrCl0wnLab/checker-CVE-2020-5902
https://github.com/d4rk007/F5-Big-IP-CVE-2020-5902-mass-exploiter
https://github.com/deepsecurity-pe/GoF5-CVE-2020-5902
https://github.com/halencarjunior/f5scan
https://github.com/renanhsilva/checkvulnCVE20205902
https://github.com/GovindPalakkal/EvilRip
https://github.com/cristiano-corrado/f5_scanner
https://github.com/inho28/CVE-2020-5902-F5-BIGIP
https://github.com/wdlid/CVE-2020-5902-fix
https://github.com/jiansiting/CVE-2020-5902
https://github.com/GoodiesHQ/F5-Patch
https://github.com/jinnywc/CVE-2020-5902
https://github.com/0xAbdullah/CVE-2020-5902
https://github.com/lijiaxing1997/CVE-2020-5902-POC-EXP
https://github.com/cybersecurityworks553/scanner-CVE-2020-5902
https://github.com/dunderhay/CVE-2020-5902
https://github.com/Un4gi/CVE-2020-5902
https://github.com/aqhmal/CVE-2020-5902-Scanner
https://github.com/dwisiswant0/CVE-2020-5902
https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5902
https://swarm.ptsecurity.com/rce-in-f5-big-ip/
https://support.f5.com/csp/article/K52145254
https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902
https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/
http://packetstormsecurity.com/files/158581/F5-Big-IP-13.1.3-Build-0.0.6-Local-File-Inclusion.html
http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html