description: On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1.0-5.4.0, an undisclosed iControl REST worker is vulnerable to command injection by an admin/resource admin user. This issue impacts both iControl REST and tmsh implementations.
problem types: privilege escalation
affected:
{
product: BIG-IP
vendor: n/a
versions:
status: affected, version: 14.1.0-14.1.0.5
status: affected, version: 14.0.0-14.0.0.4
status: affected, version: 13.0.0-13.1.1.4
status: affected, version: 12.1.0-12.1.4.1
status: affected, version: 11.6.1-11.6.3.4
status: affected, version: 11.5.2-11.5.8
}
{
product: BIG-IQ
vendor: n/a
versions:
status: affected, version: 7.0.0-7.1.0.2
status: affected, version: 6.0.0-6.1.0
status: affected, version: 5.1.0-5.4.0
}
