CVE-2025-31644

CVE-2025-31644 is a command injection flaw (CWE-77) in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that is exposed when a BIG-IP system is running in Appliance mode. An authenticated attacker who already holds the Administrator role on the device can trigger the flaw by issuing a crafted command through the affected interface. A successful exploit lets the attacker execute arbitrary system commands on the underlying operating system, crossing the intended security boundary between the administrative control plane and the system. Affected organizations are those running any of the broad set of BIG-IP modules (e.g., LTM-adjacent services such as APM, ASM, AFM, AWAF, DNS, and others) in Appliance mode on software versions still within technical support; versions past End of Technical Support (EoTS) were not evaluated. As of now there is no known exploitation in the wild and no public proof-of-concept, but the EPSS score of 26.5% (98th percentile) indicates a relatively high probability of exploitation within the next 30 days.

What to do: Inventory all BIG-IP systems and identify which run in Appliance mode, then upgrade to a fixed release listed in the F5 security advisory for CVE-2025-31644, noting that systems on EoTS software versions must move to a supported release to receive patches. Until patching is complete, restrict iControl REST and tmsh access to trusted administrators only, limit exposure of management interfaces to the internet, and review admin accounts for unnecessary Administrator-role assignments. Watch for updates to F5's advisory and KEV listings given the elevated EPSS score, and monitor management-plane logs for unexpected command activity.