CVE‑2020‑5902: F5 BIG‑IP TMUI Remote Code Execution Vulnerability
What It Is – A remote code execution (RCE) flaw exists in the Traffic Management User Interface (TMUI) of F5 BIG‑IP appliances. The vulnerability resides in undisclosed pages that can be accessed without authentication.
Exploitability – Public exploits are available; the CVSS v3.1 base score is 9.8 (Critical). The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Affected Products – All F5 BIG‑IP versions that expose the TMUI component (typically versions prior to the patches released in 2020‑2021).
Why It Matters for Trust & Control Assurance
- Patch Management – Demonstrates the need for a documented, repeatable process that tracks and applies security patches promptly, a core control for audit readiness.
- Continuous Vulnerability Monitoring – Ongoing scanning and evidence collection prove due diligence and support a defensible audit trail.
- Configuration Assurance – Verifying that TMUI is hardened or disabled aligns with control objectives around secure configuration and reduces attack surface.
Recommended Actions
- Deploy F5’s security patches for all affected BIG‑IP devices immediately.
- Run an automated inventory scan to confirm patch levels across the environment.
- Update your vulnerability‑management policy to include TMUI checks and a defined remediation timeline.
- Document the remediation steps and retain evidence for compliance audits.
Source: CISA KEV – CVE‑2020‑5902