F5 BIG-IP TMUI Remote Code Execution (RCE) and Directory Traversal Vulnerability Security Advisory (CVE-2020-5902)
Executive & SecOps Summary
SECOPS ASSESSMENTTraffic Management User Interface (TMUI), also known as the Configuration utility, in F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1
Unauthenticated remote attackers can exploit directory traversal to read arbitrary system files or execute remote commands with administrative privileges, leading to complete system compromise
Immediately upgrade to the patched versions provided by F5, or apply temporary workarounds to restrict external access to the TMUI management interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Follow F5's official guidance to upgrade to a patched hotfix or release. Below are the commands to verify and perform the upgrade via the BIG-IP CLI.
# Verify current software versions and active volumes
show sys software
# Install the downloaded secure image (e.g., BIGIP-15.1.0.4) to an inactive volume
install sys software image BIGIP-15.1.0.4.iso volume HD1.2
# Monitor the installation progress
watch show sys software status
# Reboot into the newly patched volume once installation is complete
reboot volume HD1.22. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict external access to the TMUI (port 443) and apply the following configuration block to block malicious URI patterns.
# Use tmsh to include rewrite rules blocking semicolon and hsqldb bypasses
tmsh modify sys httpd include '
<LocationMatch ";">
Redirect 404 /
</LocationMatch>
<LocationMatch "hsqldb">
Redirect 404 /
</LocationMatch>
'
# Save the configuration and restart the httpd service
tmsh save sys config
bigstart restart httpd3. Log Audit & IoC Verification Commands
Run the following commands on the BIG-IP system to inspect logs for potential exploitation attempts.
# Scan Apache access logs for directory traversal and bypass attempts
grep -E '(/\.\.\;|/tmui/locallb/workspace/|hsqldb)' /var/log/httpd/ssl_access_log
# Check audit logs for unauthorized tmsh command executions
grep -i 'tmsh' /var/log/auditStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-5902) is a critical directory traversal (CWE-22) and Remote Code Execution (RCE) flaw in the F5 BIG-IP Traffic Management User Interface (TMUI). The root cause lies in a parser inconsistency between the Apache HTTPD front-end web server and the internal Tomcat servlet container. By inserting specific characters such as semicolons (';') or parameter delimiters into the URI path, an unauthenticated attacker can bypass Apache's authentication filters and directly access restricted internal Tomcat servlets (e.g., FileReadServlet, tmshCmd).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker crafts a malicious HTTP request targeting the vulnerable endpoints. For instance, sending a request to '/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp' causes Apache to treat the request as a benign login page access, while Tomcat processes the path traversal after the semicolon, executing the file-reading servlet. This allows the extraction of sensitive configuration files and system credentials. Furthermore, by targeting the 'tmshCmd' servlet, attackers can execute arbitrary Traffic Management Shell (TMSH) commands, leading to full remote code execution under system privileges.
3. Infrastructure & Business Impact
BIG-IP appliances reside at the perimeter of enterprise networks, handling critical tasks like load balancing, SSL termination, and traffic filtering. With a CVSS score of 9.8 and active exploitation documented in CISA's KEV catalog, this vulnerability poses an extreme risk. Successful exploitation allows attackers to establish a foothold, perform lateral movement within the internal network, decrypt SSL traffic, steal sensitive credentials, or cause a complete denial of service (DoS), severely disrupting business operations.
Official Vendor Advisories & References
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Frequently Asked SecOps Questions (CVE-2020-5902)
FAQQ1. How critical is CVE-2020-5902 and is it actively exploited in the wild?
CVE-2020-5902 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-5902?
Primary impacted vendors include f5 across big-ip. Scope summary: F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1
Q3. What temporary mitigations or workarounds exist for CVE-2020-5902 before patching?
[Mitigation] Immediately upgrade to the patched versions provided by F5, or apply temporary workarounds to restrict external access to the TMUI management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-5902
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (f5)
View Category →F5 BIG-IP APM OAuth Authorization Server Remote Code Execution (RCE) Vulnerability (CVE-2026-94127)
[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.
Ubiquiti UniFi OS Path Traversal and Remote Code Execution Vulnerability (CVE-2026-34909)
[Affected Scope] All Ubiquiti UniFi OS devices accessible via the network.
Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) - Unauthenticated Arbitrary File Write
[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.
Check Point Management Server Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-93616)
[Affected Scope] Check Point Management Server (R80.x, R81.x series)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.