CVE-2026-40462
iControl REST and tmsh vulnerability
En bref Sévérité HIGH 7.1 EPSS EPSS 0.25 % · centile 16 (2026-10-27) État PUBLISHED Publiée 2026-05-13 Mise à jour 2026-05-13 Attribuée par f5 Statut NVD Analyzed Description Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N f5 CVSS 4.0 HIGH 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · f5sirt@f5.com (Secondary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · f5sirt@f5.com (Secondary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* ≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* ≥ 17.5.0 ≤ 17.5.1+44 autres Produits affectés Produit Versions F5 · BIG-IP unaffected 21.1.0 < * ; affected 21.0.0 < 21.0.0.1 ; affected 17.5.0 < 17.5.1.4 ; affected 17.1.0 < 17.1.3.1 ; affected 16.1.0 < *
Références
Sources
