{"uuid": "aa3f8aae-77b2-4432-bf8c-ac4a00b0beab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-5902", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2020_5902.rb", "content": "{\"aliases\": [\"exploit/linux/http/f5_bigip_tmui_rce\"], \"arch\": \"cmd, x86, x64\", \"author\": [\"Mikhail Klyuchnikov\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a directory traversal in F5's BIG-IP Traffic\\n          Management User Interface (TMUI) to upload a shell script and execute\\n          it as the Unix root user.\\n\\n          Unix shell access is obtained by escaping the restricted Traffic\\n          Management Shell (TMSH). The escape may not be reliable, and you may\\n          have to run the exploit multiple times. Sorry!\\n\\n          Versions 11.6.1-11.6.5, 12.1.0-12.1.5, 13.1.0-13.1.3, 14.1.0-14.1.2,\\n          15.0.0, and 15.1.0 are known to be vulnerable. Fixes were introduced\\n          in 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, and 15.1.0.4.\\n\\n          Tested against the VMware OVA release of 14.1.2.\", \"disclosure_date\": \"2020-06-30\", \"fullname\": \"exploit/linux/http/f5_bigip_tmui_rce_cve_2020_5902\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"F5 BIG-IP TMUI Directory Traversal and File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\", \"artifacts-on-disk\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2020_5902.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"linux/http/f5_bigip_tmui_rce_cve_2020_5902\", \"references\": [\"CVE-2020-5902\", \"URL-https://support.f5.com/csp/article/K52145254\", \"URL-https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:33.098047Z"}