CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

CVE-2020-5902 is a remote code execution vulnerability in the Traffic Management User Interface (TMUI) of F5 BIG-IP. It stems from a path traversal weakness (CWE-22) in undisclosed pages of the management interface. Successful abuse can let an unauthenticated attacker run commands on the device, which matters because BIG-IP often sits at the edge of networks handling traffic, authentication, and application delivery. CISA notes known ransomware use of this vulnerability, so unpatched systems remain a high-priority target.

Defenders should treat any internet-reachable or poorly segmented TMUI instance as urgent. Confirm exact affected builds, fixed releases, and configuration notes only against the official F5 advisory; do not rely on third-party summaries alone.

How it works

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) allows an attacker to craft requests that escape the intended directory scope of the TMUI web interface. In this case the flaw exists in undisclosed pages of the Traffic Management User Interface. By supplying specially formed path elements, an attacker can reach functionality that ultimately permits execution of operating-system commands on the BIG-IP host.

Because the interface is intended for administrative use, the resulting code execution typically occurs with elevated privileges on the appliance. No authentication is required when the vulnerable pages are reachable. Exact request patterns and payload construction are not detailed here; treat any public proof-of-concept as potentially incomplete or outdated and validate detection logic against the vendor advisory and your own lab testing.

Am I affected? How to find it in your systems

F5 BIG-IP appliances and virtual editions commonly run as reverse proxies, load balancers, reverse SSL terminators, or access gateways. TMUI is the web-based management interface, usually listening on a dedicated management IP or on self-IP addresses when management access has been enabled on traffic VLANs.

• Inventory every BIG-IP instance (hardware, VE, cloud marketplace images) via CMDB, network discovery, or F5’s own big3d/iControl endpoints.
• Identify which systems expose TMUI: check listening ports on management interfaces, review httpd configuration, and search firewall rules for access to the management port (commonly 443).
• Record the installed software version and hotfix level from the TMUI dashboard or the command line; compare those values only to the fixed versions listed in the F5 advisory for CVE-2020-5902.
• Look for configuration settings that broaden exposure, such as TMUI bound to non-management addresses or unrestricted source IPs.

Telemetry signs of exploitation include anomalous requests to TMUI paths containing directory-traversal sequences, unexpected creation of files under web-accessible directories, new or modified admin accounts, and command-shell or bash history entries that do not match change-control windows. Forward BIG-IP audit and httpd logs to a SIEM and alert on these patterns. Confirm any indicator of compromise against F5’s guidance before declaring an incident.

How to remediate

Patch first. Apply the updates F5 released for CVE-2020-5902 exactly as described in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; schedule the upgrade during a maintenance window that includes a configuration backup and post-upgrade verification of traffic-processing and high-availability state.

• After patching, re-validate that TMUI is reachable only from authorized management networks.
• Remove any temporary work-arounds once the fixed software is confirmed running.
• Rotate credentials and keys that may have been present on the device if you have reason to suspect prior compromise.
• Document the new software level in your asset inventory so future scans correctly identify the system as remediated.

Hardening steps that reduce the attack surface for this class of flaw include disabling TMUI on all non-management interfaces, enforcing strict source-IP allow-lists, and placing the management plane behind a jump host or VPN.

If you can't patch immediately

Implement compensating controls while you arrange the upgrade:

• Segment the management interface so it is unreachable from the internet and from general user VLANs; allow only jump-host or out-of-band management subnets.
• If the advisory lists a viable workaround (for example, disabling a specific httpd component or applying a signature), implement it exactly as written and monitor for side-effects.
• Deploy virtual-patching rules on a WAF or reverse proxy in front of TMUI to block path-traversal patterns, understanding that such rules are incomplete substitutes for the vendor patch.
• Increase logging verbosity for the management interface and forward logs in real time; alert on any request containing “..” sequences or unexpected POST activity to TMUI paths.
• Consider temporarily disabling TMUI entirely if command-line or API management is sufficient for operations.

These measures lower risk but do not eliminate it; treat them as temporary and track the patch deadline explicitly.

If your data may have been exposed

Actively exploited vulnerabilities, especially those with documented ransomware use, frequently lead to full device compromise, credential theft, and lateral movement. If logs or other evidence suggest exploitation, isolate the appliance, preserve forensic images, and begin incident-response procedures. As a further check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated credentials have appeared in prior leaks.