Introduction
Privilege escalation on a network's core load balancer can lead to full compromise of application traffic, cryptographic keys, and critical configuration data. CVE-2025-59481 is a recently disclosed vulnerability in F5 BIG-IP systems. It lets an authenticated attacker with resource administrator privileges execute arbitrary system commands with elevated privileges, which crosses an established security boundary. The flaw is especially severe in appliance mode, where exploitation requires only network access to the iControl REST endpoint.
About F5 Networks and BIG-IP F5 Networks dominates the application delivery controller and load balancing market. Enterprise, government, and service provider networks use its BIG-IP product line widely for traffic management, security, and access control. Because BIG-IP plays such a central role in infrastructure, vulnerabilities in its management interfaces have an outsized impact.
Technical information
CVE-2025-59481 is a privilege escalation vulnerability in F5 BIG-IP's iControl REST API and TMOS Shell (tmsh), classified as CWE-250 (Execution with Unnecessary Privileges). The issue comes from an undisclosed command in these management interfaces that does not enforce proper privilege separation. An authenticated attacker with the resource administrator role or higher can use it to execute arbitrary system commands with more privilege than the role is meant to have.
What the attacker needs depends on the mode:
- In standard mode, exploitation requires both network access to the iControl REST endpoint and local access to the BIG-IP system.
- In appliance mode, exploitation requires only network access to the iControl REST endpoint, which raises both the risk and the CVSS score.
In either mode, the attacker crosses a privilege boundary, and that undermines the role-based access control model in BIG-IP.
No public code snippets or proof of concept are available for this vulnerability. The root cause is that certain commands in the management interfaces are granted excessive privileges, which breaks the principle of least privilege.
Affected systems and versions
- Affects F5 BIG-IP systems with iControl REST and tmsh components
- Vulnerable in both standard and appliance mode
- Only supported versions are evaluated. Versions that have reached End of Technical Support (EoTS) are not evaluated.
- For specific fixed versions, see F5 advisory K000156642 (link)
Vendor security history
F5 has a history of management plane vulnerabilities in BIG-IP products:
- CVE-2020-5902: Remote code execution in TMUI, exploited rapidly
- CVE-2022-1388: iControl REST authentication bypass and remote code execution
- CVE-2025-23239: Appliance mode bypass via iControl REST
- CVE-2025-20029: Command injection in the tmsh save command
F5 now releases security notifications quarterly, along with detailed advisories and patch information. Despite those improvements, privilege escalation and command execution flaws keep recurring, which points to unresolved architectural problems in how the management interfaces are secured.
