F5 Security Updates – 06 February 2025

The addressed vulnerabilities could allow the attacker to conduct cross-site scripting attacks, bypass security restrictions, obtain sensitive information, or execute arbitrary codes and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. BIG-IP iControl REST and BIG-IP TMOS Shell (tmsh) Vulnerability (CVE-2025- 20029):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. BIG-IP iControl REST Security Bypass Vulnerability (CVE-2025-23239):

• CVSS: 8.7
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Bypass Security

3. BIG-IP Configuration Utility Vulnerability (CVE-2025-24320):

• CVSS: 8.0
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Consequences: Cross-Site Scripting