CVE-2025-61958
📋 TL;DR
This vulnerability allows authenticated attackers with resource administrator privileges to bypass tmsh restrictions and gain bash shell access on BIG-IP systems. In Appliance mode, successful exploitation can enable crossing security boundaries. Affects F5 BIG-IP systems running vulnerable versions that haven't reached End of Technical Support.
💻 Affected Systems
- F5 BIG-IP
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full system control, potentially compromising the entire network infrastructure, exfiltrating sensitive data, and establishing persistent backdoors.
Likely Case
Privileged attackers escalate to root access, modify configurations, install malware, and pivot to other systems in the network.
If Mitigated
Attackers remain contained within their authorized resource boundaries with limited impact on overall system security.
🎯 Exploit Status
Requires authenticated access with at least resource administrator role. Exploitation likely involves specific iHealth command manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000154647 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000154647
Restart Required: Yes
Instructions:
1. Review F5 advisory K000154647. 2. Identify affected BIG-IP versions. 3. Download and apply appropriate patches from F5 downloads. 4. Restart affected systems as required. 5. Verify patch application.
🔧 Temporary Workarounds
Restrict iHealth Command Access
allLimit access to iHealth commands for resource administrator roles
# Consult F5 documentation for specific role-based access control configuration
Enhanced Monitoring
allImplement strict monitoring of iHealth command usage and shell access attempts
# Configure logging for tmsh and bash access attempts
🧯 If You Can't Patch
- Implement strict network segmentation to isolate BIG-IP systems
- Enforce least privilege access controls and monitor resource administrator activities
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version against affected versions in F5 advisory K000154647Check Version:
tmsh show sys versionVerify Fix Applied:
Verify installed version matches or exceeds patched versions listed in F5 advisory📡 Detection & Monitoring
Log Indicators:
- Unauthorized bash shell access attempts
- iHealth command execution anomalies
- Privilege escalation patterns
Network Indicators:
- Unexpected outbound connections from BIG-IP systems
- Anomalous administrative traffic patterns
SIEM Query:
source="bigip_logs" AND (event="bash_access" OR command="ihealth")