CVE-2025-31644 PoC — Appliance mode BIG-IP iControl REST and tmsh vulnerability

Description

CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP

Readme

# CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP

The “file” parameter of the “save” command is vulnerable to a command injection attack, allowing an authenticated attacker with administrator privileges to the “/mgmt” web API or the SSH “tmsh” shell, to obtain remote code execution as the “root” user on the target system.

**Note:** This finding is only considered a vulnerability when BIG-IP is run in Appliance mode as this may allow an authenticated attacker with administrator role to bypass the Appliance mode security that would otherwise prevent the execution of arbitrary Advanced Shell (bash) commands.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://my.f5.com/manage/s/article/K000148591).

### Requirements:

This vulnerability requires:
<br/>
- Valid user credentials
- The capability to send requests to the iControl REST component and/or the capability to execute tmsh commands

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2025-31644/blob/main/F5%20-%20CVE-2025-31644.pdf).

File Snapshot

Remarks